I'm using Ubuntu 18.04

I'm trying to access a file on another server using CURL. The other server has a Commodo/PositiveSSL certificate, and CURL reports that: curl: (60) SSL certificate problem: unable to get local issuer certificate

I HAD been using a self-signed certificate, but have replaced it and with a genuine cert specifically to not have to deal with SSL warnings.

One tip I read said to uninstall openssl and ca-certificates, and reinstall, which I did, and I still get the error. I checked the certificate itself to make sure I wasn't using the self-signed by accident with openssl s_client -connect my-other-server.example.com:443, and that query shows that I am indeed using the newly issued certificate.

So, either I need to import the Komodo/PositiveSSL root certificate, or CURL is using a cached version.

Anyone have any ideas?

  • 1
    I find it more likely that the certificate is not correctly installed. Check with SSLLabs and specifically look out for errors like "incomplete chain". Mar 21 '19 at 21:15
  • When I access the same server from MacOS, I don't get any errors at all. That's why I'm scratching my head. I installed the new Cert, opened the page in Chrome, all was good. Tried to make my CURL request, and got the error. Mar 21 '19 at 23:29
  • 1
    This is exactly the type of behavior you see when the server is not properly configured to provide all intermediate certificates. Browsers often work around such misconfiguration, simpler clients like curl don't. Again, please check your site with SSLLabs as I've already said. Mar 22 '19 at 5:05
  • There we go, thank you! Appended the ca-bundle to the crt into a pem file, and all was good. I'm used to apache, not nginx, and it slipped my mind. Many thanks! Mar 22 '19 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.