2

After upgrade to 15.10 i've got error 35 'Unknown SSL protocol error in connection to ...' when i'm trying to access SSL-secure server using CURL from PHP script (PHP5-fpm). Before the upgrade all worked just fine. Any idea how to fix this?

apt-cache policy curl
curl:
  Installed: 7.43.0-1ubuntu2
  Candidate: 7.43.0-1ubuntu2
  Version table:
 *** 7.43.0-1ubuntu2 0
        500 http://ua.archive.ubuntu.com/ubuntu/ wily/main amd64 Packages
        100 /var/lib/dpkg/status

Accessing to https://w3s.webmoney.ru:443

|improve this question
  • Edit your question and add the output of apt-cache policy curl – A.B. Nov 23 '15 at 19:58
  • And what is your curl command? Which protocols are supported by the target server? Is your key expired? – A.B. Nov 23 '15 at 20:00
  • w3s.webmoney.ru:443 – very funny: curl: (60) server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none – A.B. Nov 23 '15 at 20:04
  • I've read that there was a problem with CURL causing "Unknown SSL protocol error" . But it was fixed long ago (ver. 7.38 or so). And there was no errors while I was on Ubuntu 15.04. So it makes me think that some upgrades (CURL, openSLL etc) lead to such error – Rual Ilmarranen Nov 23 '15 at 20:07
0

The server https://w3s.webmoney.ru:443 is not trustworthy.

% curl https://w3s.webmoney.ru:443
curl: (60) server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

Run

curl --insecure https://w3s.webmoney.ru:443

and it works.

From man curl

-k, --insecure
    (SSL) This option explicitly allows curl to perform "insecure" SSL
    connections and transfers. All SSL connections are attempted to be
    made secure by using the CA certificate  bundle  installed  by
    default. This makes all connections considered "insecure" fail unless
    -k, --insecure is used.

Add trusted certificates with

  1. Add the path to the certificate to

    /etc/ca-certificates.conf

    use a path relative to /usr/share/ca-certificates

  2. Run sudo update-ca-certificates

For further instructions read man update-ca-certificates

Taken from the comments:

FYI: The same site has SSLv3 and SSLv2 enabled - it's BAD and not trustworthy at all because of that

|improve this answer
  • Thanks for the solution, but here is the thing: at another server, with older software, my PHP script works as is, without any modifications. After going 15.10 this problem appeared. So I'm wondering what's changed? – Rual Ilmarranen Nov 24 '15 at 14:49
  • The list of trusted certificates has changed. /etc/ssl/certs/ca-certificates.crt – A.B. Nov 24 '15 at 15:29
  • Updated my answer. – A.B. Nov 24 '15 at 15:36
  • Thank you so much! After finding the list of certificates I was able to add missing ones. I understand that target site is not trustworthy and uses obstolete SSL, but there is no way to fix it, so... – Rual Ilmarranen Nov 24 '15 at 16:32
  • 1
    FYI: The same site has SSLv3 and SSLv2 enabled - it's BAD and not trustworthy at all because of that – Thomas Ward♦ Apr 13 '16 at 16:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.