We're having trouble with
curl not connecting to an HTTPS server:
$ curl https://the-problem-site.com (not the real URL!) curl: (35) error:14077458:SSL routines:SSL23_GET_SERVER_HELLO:reason(1112)
If I try
openssl s_client -connect the-problem-site.com:443 instead then I see
CONNECTED(00000003) depth=1 /C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA verify error:num=20:unable to get local issuer certificate verify return:0 Certificate chain 0 s:/serialNumber=xx/C=xx/ST=xx/L=xxxx/O=xx/OU=xx/CN=the-problem-site.com i:/C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA 1 s:/C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
i.e. it looks like the problem is that it doesn't trust
/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA. However that cert is installed: it's
/etc/ssl/certs/GeoTrust_Global_CA.pem, and if instead I run
openssl s_client -connect the-problem-site.com:443 -CAfile /etc/ssl/certs/GeoTrust_Global_CA.pem
then everything works. The cert is also present as a hash-named file
b0f3e76e.0 and it's in
ca-certificates.crt. However, as far as I can see, neither curl nor openssl are attempting to read any certificates; if I
strace them then there's no attempt to read from
/etc/ssl/certs at all, not even with errors. It does read openssl.cnf though. We have run
This is Ubuntu 10.04 with openssl 0.9.8k. We can reproduce the problem on two separate installs (though it's possible one's a clone of the other from way back). If I try the same test on a CentOS VM with openssl 0.9.8e then it works fine, and I can see it reading the certificate file in
strace. There's no equivalent file access at the same point in the Ubuntu straces. If I copy the
openssl.cnf file from the CentOS VM to the Ubuntu machines it makes no difference. There's nothing obvious in the environment or an .rc file that might be causing this.
Any ideas what I'm doing wrong? Should this work, i.e. should openssl and curl pick up installed CAs automatically from the command-line? How is this configured? Thanks!
Another data point: on a clean install of 13 server,
curl does pick up the certificates file and work fine.
openssl s_client still does not, though. Why would that be?