curl SSL issue with RapidSSL certificates

Question

I'm getting the famous "SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed" problem when attempting to curl a domain that has a rapidssl certificate installed.

I'm running Ubuntu 10.10 and I have openssl installed with a huge /etc/ssl/certs directory. I've tried using the --cacert and --capath arguments.

Nothing seems to work with this specific domain, even though when I visit the site with my web browser it authenticates the certificate.

However, when I curl https://google.com, it has no problem.

What am I doing wrong?

If you provide the domain name in question, it would be easier to have an oppinion. — Kvisle, Oct 26 '11 at 21:14

Kvisle · Accepted Answer · 2011-10-26T21:25:39.220

3

Make sure that you specify www.phaxio.com, and not just phaxio.com. The latter does not provide with a valid certificate, and could be your problem.

https://www.phaxio.com is using a wildcard-certificate. This should validate as long as you specify a prefix to .phaxio.com. This means that phaxio.com is invalid, but www.phaxio.com is valid.

However, phaxio.com actually presents itself with a certificate for an entirely different domain.

The date on the computer you're running curl on could be set to a time outside the certificates validity period. It's valid from 18th September 2011.

The root-certificate list could be too old - the CA-certificate is dated 19th February 2010. (This is probably not the case in Ubuntu 10.10, though).

edited Oct 26 '11 at 21:25

answered Oct 26 '11 at 21:19

Kvisle

4,193
24
25

You would think so, but I'm getting the same problem with the www prefix. – Josh Nankin Oct 26 '11 at 21:21
Updated my reply. – Kvisle Oct 26 '11 at 21:25
Had to pem the rapidssl certificate and add it to my cert bundle. That did the trick. Rapidssl is trusted by Geotrust, and I have other domains that have rapidssl certificates that have not had this problem, so not exactly sure why I had to do this. – Josh Nankin Oct 26 '11 at 22:00
Interesting, so it looks like my other rapidssl certs are issued directly by Equifax, whereas this one is issued by rapidssl which has a certificate issued by geotrust. They must have changed the way they setup their hierarchy, and the rapidssl ca is not included by default in the certificate listing. Bummer! – Josh Nankin Oct 26 '11 at 22:17

score 3 · Answer 2 · answered Oct 26 '11 at 22:10

Create a file with this info: (RapidSSL+GeoTrust Certs)

then use:

curl --cacert <newfile> https://www.phaxio.com

curl SSL issue with RapidSSL certificates

2 Answers2