0

i have a few servers likely installed with the same OS Ubuntu Xenial image, and only one of these servers show me an error when trying to fetch some famous websites in SSL :

curl https://forums.openvpn.net/

curl: (60) server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

but fetching https://google.com or https://askubuntu.com works.

I've tried most answers seen around and none worked. Could such problem arise from the network outside my OS ?

2
  • Have you tried an openssl s_client to get more detailed information? Jul 12, 2020 at 7:50
  • There's some error 21 cannot verify first certificate for forums.openvpn.net, but the main url i fetch has valid certificates, and the error is just gone by the way. Go figure. But the error is real for sure as my crawling program stalled and couldn't fetch the main page until i added the -k option. Jul 12, 2020 at 12:40

2 Answers 2

2

I tried by my side and le curl fetches with success
Something may be wrong at your side (System Date & Time are ok?)

You could bypass certificate verification with the -k option of curl

curl -k https://forums.openvpn.net/
2
  • 3
    Recommending -k whenever there's a certificate issue is somewhat dangerous for the Web PKI... Finding the cause of the error would be better than training people to ignore security errors; or at least add a disclaimer before suggesting it. Jul 12, 2020 at 7:49
  • That's what i did though since my error couldn't be resolved by trying numerous solutions i found around. What's more disturbing is that it was happening on a virgin Xenial install at Scaleway. Jul 12, 2020 at 12:41
1

I have Ubuntu 16.04 servers with curl version 7.47.0 and updating the certificates as suggested was not enough to resolve the issue.

The issue was resolved only after I downloaded and installed a statically liked curl version 7.79.1 from: https://github.com/moparisthebest/static-curl/releases/download/v7.79.1/curl-amd64

Download the binary that matches your OS architecture and rename it:

/usr/local/bin/curl

Enjoy.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.