3

i have a few servers likely installed with the same OS Ubuntu Xenial image, and only one of these servers show me an error when trying to fetch some famous websites in SSL :

curl https://forums.openvpn.net/

curl: (60) server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

but fetching https://google.com or https://askubuntu.com works.

I've tried most answers seen around and none worked. Could such problem arise from the network outside my OS ?

Improve this question
2
  • Have you tried an openssl s_client to get more detailed information?
    – Ginnungagap
    Jul 12, 2020 at 7:50
  • There's some error 21 cannot verify first certificate for forums.openvpn.net, but the main url i fetch has valid certificates, and the error is just gone by the way. Go figure. But the error is real for sure as my crawling program stalled and couldn't fetch the main page until i added the -k option.
    – Benjamin Quellier
    Jul 12, 2020 at 12:40

2 Answers 2

Reset to default
5

I tried by my side and le curl fetches with success
Something may be wrong at your side (System Date & Time are ok?)

You could bypass certificate verification with the -k option of curl

curl -k https://forums.openvpn.net/
Improve this answer
2
  • 3
    Recommending -k whenever there's a certificate issue is somewhat dangerous for the Web PKI... Finding the cause of the error would be better than training people to ignore security errors; or at least add a disclaimer before suggesting it.
    – Ginnungagap
    Jul 12, 2020 at 7:49
  • That's what i did though since my error couldn't be resolved by trying numerous solutions i found around. What's more disturbing is that it was happening on a virgin Xenial install at Scaleway.
    – Benjamin Quellier
    Jul 12, 2020 at 12:41
1

I have Ubuntu 16.04 servers with curl version 7.47.0 and updating the certificates as suggested was not enough to resolve the issue.

The issue was resolved only after I downloaded and installed a statically liked curl version 7.79.1 from: https://github.com/moparisthebest/static-curl/releases/download/v7.79.1/curl-amd64

Download the binary that matches your OS architecture and rename it:

/usr/local/bin/curl

Enjoy.

Improve this answer
1
  • 1
    This sounds dangerous. Suggesting people to replace an essential system tool with a binary downloaded from someone's github page raises questions. The main one being, how do we know this is not a phishing attempt, how do we know the binary has no malware baked into it. We all appreciate contributions, but tools that are often run with sudo on one system need to pass a high bar in terms of verification of authenticity. How can this verification be done in this case?
    – Christian Fritz
    Aug 16, 2022 at 21:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .