11

I'm trying to access an internal site via cURL (which I could access several days ago). However, cURL gives the error curl: (60) SSL certificate problem: certificate has expired. If I use openssl to check the start and end dates of the certificate, it gives a timeframe that I'm well within:

echo | openssl s_client -connect internalsite.example.com:443 2>/dev/null | openssl x509 -noout -dates
notBefore=Nov 30 00:00:00 2012 GMT
notAfter=Mar 30 12:00:00 2016 GMT
# For reference, the day I'm posting this is July 30th, 2014

Additionally, if I use cURL on a different computer, or connect via the browser (Firefox, Chrome, or IE), I can connect without error.

Also, I'm unable to connect with any version of cURL on my own computer; this includes cURL in Cygwin and cURL on Ubuntu inside a virtual machine, as well as the Windows version.

What might give rise to this behaviour?

Eugene Mayevski 'Callback
  • 45,135
  • 8
  • 71
  • 121
lelandbatey
  • 193
  • 1
  • 1
  • 13
  • Is it possible that the internal site is using SNI, and the certificate for the site you're hitting is expired? Or that one of the signers for the certificate has expired? –  Jul 30 '14 at 22:08
  • I don't think so. Running the exact same commands on other machines works fine, and other people's cURL can connect to the server just fine. I'm really confused as to what could cause this. – lelandbatey Jul 30 '14 at 22:19
  • Sorry for asking, but did you check your local clock? – Remi Gacogne Jul 31 '14 at 14:04
  • @RemiGacogne I did check my local clock, in my host and my virtual machine. Both are accurate. Here's a screenshot: http://i.imgur.com/t2Yz6fH.png – lelandbatey Jul 31 '14 at 19:19

3 Answers3

4

Your cert bundle is probably out of date.

You can get one that's maintained by the curl developers at http://curl.haxx.se/ca/cacert.pem

To use it:

<?
$ch = curl_init("http://example.com");
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_CAINFO, '/path/to/cacert.pem');
$response = curl_exec($ch);
Jaime
  • 1,402
  • 7
  • 15
  • I updated my cert bundle using the one from the curl devs, and I even re-installed curl. Neither of those things resolved the problems I'm having. – lelandbatey Jul 30 '14 at 23:31
3

If you need a quick and temporary workaround, you can always disable SSL verification, as shown below. Don’t do that if you can avoid it, especially in production or if that request is transmitting sensitive data. Remember that you might be making a request to https://stackoverflow.com but actually sending data to another computer entirely.

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
sylbru
  • 1,461
  • 1
  • 11
  • 19
2

My curl is using the certificate bundle stored in:

/etc/ssl/certs/ca-certificates.crt

I've had this problem in the past, and I fixed it by looking at a machine where curl was working and comparing the .crt files from those two machines, and copying the missing certificate over.

I just had this problem again, and I fixed it this time by just copying the entire file over from the newer machine (a more recent Ubuntu install----the machine where I have the problem is ancient).

And it worked.

Jason Rohrer
  • 503
  • 4
  • 14
  • This seems not to work (anymore?). I've had this issue on an Ubuntu 16 machine and another Ubuntu 16 was working, but copying the file and telling curl to use it didn't help in any way. – Paolo Stefan Jan 24 '20 at 13:38