i have a few servers likely installed with the same OS Ubuntu Xenial image, and only one of these servers show me an error when trying to fetch some famous websites in SSL :

curl https://forums.openvpn.net/

curl: (60) server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

but fetching https://google.com or https://askubuntu.com works.

I've tried most answers seen around and none worked. Could such problem arise from the network outside my OS ?

  • Have you tried an openssl s_client to get more detailed information? Jul 12, 2020 at 7:50
  • There's some error 21 cannot verify first certificate for forums.openvpn.net, but the main url i fetch has valid certificates, and the error is just gone by the way. Go figure. But the error is real for sure as my crawling program stalled and couldn't fetch the main page until i added the -k option. Jul 12, 2020 at 12:40

2 Answers 2


I tried by my side and le curl fetches with success
Something may be wrong at your side (System Date & Time are ok?)

You could bypass certificate verification with the -k option of curl

curl -k https://forums.openvpn.net/
  • 3
    Recommending -k whenever there's a certificate issue is somewhat dangerous for the Web PKI... Finding the cause of the error would be better than training people to ignore security errors; or at least add a disclaimer before suggesting it. Jul 12, 2020 at 7:49
  • That's what i did though since my error couldn't be resolved by trying numerous solutions i found around. What's more disturbing is that it was happening on a virgin Xenial install at Scaleway. Jul 12, 2020 at 12:41

I have Ubuntu 16.04 servers with curl version 7.47.0 and updating the certificates as suggested was not enough to resolve the issue.

The issue was resolved only after I downloaded and installed a statically liked curl version 7.79.1 from: https://github.com/moparisthebest/static-curl/releases/download/v7.79.1/curl-amd64

Download the binary that matches your OS architecture and rename it:



  • 1
    This sounds dangerous. Suggesting people to replace an essential system tool with a binary downloaded from someone's github page raises questions. The main one being, how do we know this is not a phishing attempt, how do we know the binary has no malware baked into it. We all appreciate contributions, but tools that are often run with sudo on one system need to pass a high bar in terms of verification of authenticity. How can this verification be done in this case? Aug 16, 2022 at 21:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .