Problem:
$ curl https://github.com/
curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
Background:
My machine is in my companies local intranet and some sites are intercepted by our companies MITM proxy.
I know that I need to mark the certificate as trusted after export that certificate to a file. I'm trying to automate this process so I can make my life a little easier whenever I'm behind my company's MITM proxy.
Trying to google this topic has been difficult and has mainly yielded results about how to trust a certificate you have already downloaded, but that's not what I need in this case. How can I download my company's MITM proxy's self-signed certificate?
Homework:
This question is different from the following questions for the reason of,
- How to trust self-signed certificate in cURL command line?, which is asking about self-signed certificate for foo.localhost using a Let's Encrypt recommendation.
- Wget or curl a self-signed certificate from server, because it asks for downloading the public server's public self-signed certificate.
Questions:
How to download my companies MITM proxy's self-signed certificate?
In my previous company the intercepted site was jsonplaceholder.typicode.com, So I used
openssl s_client -connect jsonplaceholder.typicode.com:443 -showcerts
to collect CERTIFICATE blocks for zscaler. However, certificates collected this way have a very short expiration date and will expire by itself later on.
In my current company the intercepted site is github.com. When I do openssl s_client -connect github.com:443, I'll get:
$ openssl s_client -connect github.com:443
CONNECTED(00000003)
depth=2 C = CA, O = MY_COMPANY, CN = MY_COMPANY Root CA
verify error:num=19:self signed certificate in certificate chain
. . .
-----END CERTIFICATE-----
subject=C = US, ST = California, L = San Francisco, O = "GitHub, Inc.", CN = github.com
issuer=C = CA, ST = British Columbia, L = xxx, O = MY_COMPANY, CN = theissuer.my_company.com
However I wasn't able to make use of theissuer.my_company.com to acquire my company's MITM proxy's self-signed certificate:
$ openssl s_client -connect theissuer.my_company.com
140082197501248:error:2008F002:BIO routines:BIO_lookup_ex:system lib:../crypto/bio/b_addr.c:730:Name or service not known
connect:errno=22
$ openssl s_client -connect my_company.com
. . .
-----END CERTIFICATE-----
subject=C = CA, ST = British Columbia, L = xxx, O = MY_COMPANY, CN = www.my_company.com
issuer=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = Thawte RSA CA 2018
```
So, once again,
How to download my companies MITM proxy's self-signed certificate?
