We're having trouble with curl
not connecting to an HTTPS server:
$ curl https://the-problem-site.com (not the real URL!)
curl: (35) error:14077458:SSL routines:SSL23_GET_SERVER_HELLO:reason(1112)
1112 is SSL_R_TLSV1_UNRECOGNIZED_NAME
in ssl.h
.
If I try openssl s_client -connect the-problem-site.com:443
instead then I see
CONNECTED(00000003)
depth=1 /C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA
verify error:num=20:unable to get local issuer certificate
verify return:0
Certificate chain
0 s:/serialNumber=xx/C=xx/ST=xx/L=xxxx/O=xx/OU=xx/CN=the-problem-site.com
i:/C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA
1 s:/C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA
i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
i.e. it looks like the problem is that it doesn't trust /C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
. However that cert is installed: it's /etc/ssl/certs/GeoTrust_Global_CA.pem
, and if instead I run
openssl s_client -connect the-problem-site.com:443 -CAfile /etc/ssl/certs/GeoTrust_Global_CA.pem
then everything works. The cert is also present as a hash-named file b0f3e76e.0
and it's in ca-certificates.crt
. However, as far as I can see, neither curl nor openssl are attempting to read any certificates; if I strace
them then there's no attempt to read from /usr/lib/ssl/certs
or /etc/ssl/certs
at all, not even with errors. It does read openssl.cnf though. We have run update-ca-certificates
.
This is Ubuntu 10.04 with openssl 0.9.8k. We can reproduce the problem on two separate installs (though it's possible one's a clone of the other from way back). If I try the same test on a CentOS VM with openssl 0.9.8e then it works fine, and I can see it reading the certificate file in strace
. There's no equivalent file access at the same point in the Ubuntu straces. If I copy the openssl.cnf
file from the CentOS VM to the Ubuntu machines it makes no difference. There's nothing obvious in the environment or an .rc file that might be causing this.
Any ideas what I'm doing wrong? Should this work, i.e. should openssl and curl pick up installed CAs automatically from the command-line? How is this configured? Thanks!
Another data point: on a clean install of 13 server, curl
does pick up the certificates file and work fine. openssl s_client
still does not, though. Why would that be?