0

Linux: Ubuntu 21.10
HTTP Server: Apache/2.4.48 (Ubuntu)
SSL Certificate Type: Wildcard
SSL Certification Issued By: Sectigo Limited (i.e. NOT SELF-SIGNED)

The problem: Mediawiki does an internal loopback HTTPS call to load its visual GUI editor. The problem (as noted in many googled posts) is that the certificate verification fails because Mediawiki is trying to contact itself. In other words, if this command fails when issued from the same server (localhost) serving MediaWiki:

$ curl 'https://host.domain.com/rest.php/v1/page/Main_Page'

...then the visual editor will fail. Which it does. The rest of the MediaWiki site works fine when making HTTPS from remote clients.

Failure detail:

$ curl 'https://host.domain.com/rest.php/v1/page/Main_Page'
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

But the certificate is valid. It works fine when we make web calls NOT from the localhost. I also visited the CURL link provided in the error message but I didn't see anything relevant to my situation.

Question: What do I need to do to get curl to NOT fail when issuing that curl call from the localhost?

1
  • I do not think that the Sectigo root certs are in the nss database, which means you have to install them yourself onto the localhost.
    – Bib
    Feb 10, 2022 at 16:15

1 Answer 1

1

The curl 'https://host.domain.com/rest.php/v1/page/Main_Page' command fails when being run from the host host.domain.com? That's definitely related to missing the certificate issuer's root certificate(s) from the local system.

Remember, curl is the client here and needs to be able to verify the certificate chain from the root to the webserver.

The webserver should be configured to produce enough of the chain to get from the public signing certificate to itself, but you need to have the root certificate.

On Debian I would try updating the package of certificates

apt install ca-certificates

If that didn't help, I'd then need to obtain the public root certificate to add to /usr/local/share/ca-certificates and then run update-ca-certificates to rebuild the certificate database. (See man update-ca-certificates for more details.)

1
  • Thank you very much. I think I understand the problem now. But Sectigo is confusing me. Which certificate(s) should I download from their page? sectigo.com/knowledge-base/detail/…
    – Van
    Feb 15, 2022 at 18:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .