cURL 60 error when trying to access my website's XML file

Question

When I use "curl -v https://hostname/resource.xml" I get the following error:

About to connect() to hostname.com port 443 (#0)
Trying x.x.x.x... connected
Connected to hostname.com (x.x.x.x) port 443 (#0)
Initializing NSS with certpath: sql:/etc/pki/nssdb
 CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
Peer's certificate issuer is not recognized: 'CN=InCommon RSA Server CA,OU=InCommon,O=Internet2,L=Ann Arbor,ST=MI,C=US'
NSS error -8179
Closing connection #0
Peer certificate cannot be authenticated with known CA certificates
curl: (60) Peer certificate cannot be authenticated with known CA certificates
More details here: http://curl.haxx.se/docs/sslcerts.html

However, when I try: "curl -v https://google.com/" everything works just fine!

The certificates that validate the websites are located in /etc/ssl/certs

I can assume that this is an issue with SSL certificates and validation because when I run the curl command with -k it works!

I have tried the following to troubleshoot:

Confirmed that date/time is correct on the server

updated the cacert.pem certificate (source: cURL error 60: SSL certificate: unable to get local issuer certificate)

Confirmed that Apache configuration is correct

Tried adding the SSL certificate (website.crt) to /etc/pki/tls

I am running:

CentOS release 6.10 (Final)
curl 7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
PHP 7.1.32 (cli)

Would this be caused due to SSLCertificateChain being incomplete?

Any help here is appreciated!

score 0 · Accepted Answer · answered Oct 03 '19 at 13:10

It appears the issuer of your website certificate is an intermediate certificate
CN=InCommon RSA Server CA,OU=InCommon,O=Internet2,L=Ann Arbor,ST=MI,C=US
but it is not sending the full chain, i.e. it is only sending the website certificate without this intermediate certificate. You have 2 options:

Updated the website configuration to bundle the intermediate certificate with the website certificate (preferred method).
Follow the instructions here to update the Apache configuration to use the intermediate certificate.

Basically you have to modify the httpd.conf file of your Apache installation, specifically the Virtual Host settings for your website, and point the SSLCertificateChainFile setting to the PEM (crt) file that contains the intermediate cert (CN=InCommon RSA Server CA,OU=InCommon,O=Internet2,L=Ann Arbor,ST=MI,C=US)

You can find the intermediate certificate you are missing on the web, for example here, and save this content to a file (e.g. incommon_rsa.crt). Here is what you need to save in the file:

Add the intermediate certificate to the list of system-trusted CA certificates (less-preferred method, intermediate certificates should be sent by clients and not trusted implicitly by adding it to the list of system-trusted CA certs ).

Again, save the intermediate certificate file with the content I provide above and then install it in your list of trusted CA certificates using the CentOS tools for doing this as described here.

Thank you for responding! I was able to resolve this issue by using the intermediate certificate to complete the chain. — J.V Wilde, Oct 09 '19 at 14:23
@J.VWilde Glad to hear you resolved it. Please don't forget to mark this as the accepted answer. — Ashaman Kingpin, Oct 10 '19 at 14:49

cURL 60 error when trying to access my website's XML file

1 Answers1