I have a couple of Raspberry Pies that upload webcam images to a web host using a bash shell script.

This is the upload code, which is identical on each Pi:

        curl -s -S -u myname: \
        --connect-timeout 25 \
        --max-time 40 \
        --retry 3 \
        --pubkey ~/.ssh/id_rsa.pub \
        -T $file $host >> $log 2>&1

The host is: sftp://ftp.mydomain.com/~/public_html/

This has been working fine on both Pies for several years now.

I recently fat-finger overwrote the ~/.ssh/known_hosts file on one of the Pies. That instantly caused the curl error 60:

curl: (60) SSL peer certificate or SSH remote key was not OK
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

I created a new, empty known_hosts file and logged in from the broken Pi to the web host using ssh on the command line. That worked fine. No password required.

Unfortunately the only way I could figure out how to fix on curl this was by using the curl insecure option (-k).

The other Pi, which uses identical code, continues to work just fine without the insecure option.

Since I didn't make any changes to the certificate on the broken Pi or on the host, I can't figure out what's going on here.

Can anyone explain so I can fix this in a less insecure way?


Edit: Here's how the known_hosts file got overlaid. I got the following error message in the status log of a systemd reverse SSH tunnel service:

Mar 24 11:43:30 raspcondo ssh[946]: Offending ECDSA key in /home/pi/.ssh/known_h
Mar 24 11:43:30 raspcondo ssh[946]:   remove with:
Mar 24 11:43:30 raspcondo ssh[946]:   ssh-keygen -f "/home/pi/.ssh/known_hosts" 

Of course, those instructions are erroneous (I assume they are truncated) because they cause known_hosts to be overwritten with a new private key. It should be something like:

ssh-keygen -f "/home/pi/.ssh/known_hosts" -R "host"
  • 2
    Can you not just copy the file from the working pi? Mar 24, 2023 at 7:32
  • 1
    Yes, that worked. Why didn't the curl error message or the page the error message referred to never mention the known_hosts file and only talk about TLS certificates? I was going to copy the known_hosts file but after reading the web page I was under the illusion that it only had to do with TLS certificate and figured (wrongly) that it wouldn't work. Anyway, I spent hours reading stuff that was simply misleading. I thank you for cutting that short. -- Please post your comment as an answer so I can accept it.
    – Buadhai
    Mar 24, 2023 at 7:46

1 Answer 1


Copy the missing file from the otherwise-identical Pi. See if that works

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .