14

I'm using cUrl to request data from a corporate website site using a .cer certificate that they sent me. This is the command:

cUrl --header "Content-Type: text/xml;charset=UTF-8" \
     --data @bustaRequestISEE2015ConsultazioneAttestazione.xml \
     -o bustaResponseISEE2015ConsultazioneAttestazione.xml \
     --cert ./caaffabisrl.cer \
     https://istitutonazionaleprevidenzasociale.spcoop.gov.it/PD

When I run it, I get this error message:

curl: (58) could not load PEM client certificate, OpenSSL error error:0906D06C:PEM routines:PEM_read_bio:no start line, (no key found, wrong pass phrase, or wro ng file format?)

Is there anybody who can help me?

Tks, Cristiano.

Daniel Stenberg
  • 54,736
  • 17
  • 146
  • 222
Cristiano Ansaloni
  • 141
  • 1
  • 1
  • 3

3 Answers3

24

It is not possible to connect to a TLS server with curl using only a client certificate, without the client private key. Either they forgot to send you the private key file, or, what they sent you was not the client certificate but the server certificate for verification.

The first thing I would try is using --cacert instead of --cert. That is, tell curl that this is the server's certificate that curl can use to verify that the server is who you think it is.

You can also try removing --cert and not using --cacert, and you will probably get an error that the server is not trusted. Then add the --insecure argument and see if that works. I would not keep that argument, as then you have no proof of who you are talking to.

My guess is that it is the server cert, and that using --cacert instead of --cert will solve the problem.

Jim Flood
  • 8,144
  • 3
  • 36
  • 48
  • had same error response, change to `--cacert` fixed it. – Kevin Won Jan 04 '19 at 19:54
  • 1
    Changing to `--cacert` i have the following error: `curl: (35) error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure` – C-lio Garcia Mar 17 '20 at 14:31
  • I found [this answer](https://stackoverflow.com/questions/32253909/curl-with-a-pkcs12-certificate-in-a-bash-script) was helpful as it worked for my version. – Michael Behrens Aug 16 '23 at 19:39
4

My guess is that your certificate file is a DER encoded binary certificate instead of base-64 encoded certificate. To covert the from binary to base-64, you can use OpenSSL.

openssl x509 -inform der -in certificate.cer -out certificate.pem

I always forget all the arguments and have the following site bookmarked, as it gives examples of how to convert pretty much any certificate format. https://www.sslshopper.com/ssl-converter.html

kah608
  • 545
  • 2
  • 10
  • Thanks @kah608, I converted the certificate as you suggest but now I get this error message: curl: (58) unable to set private key file: './caaffabisrl.pem' type PEM. Can you help me? – Cristiano Ansaloni Apr 06 '16 at 06:36
  • @CristianoAnsaloni It is hard to know exactly why this is happening. Take a look at this website, it has more information and troubleshooting steps: http://honglus.blogspot.in/2012/03/fix-curl-client-certificate-error-curl.html – kah608 Apr 06 '16 at 14:57
  • @kah608 do you know why I am getting this error? https://stackoverflow.com/q/60754143/1084174 – Sazzad Hissain Khan Mar 19 '20 at 09:23
0

First, you need to specify whether you're expected to perform two-way TLS/SSL or MTLS (mutual TLS). This would typically be the reason for sending a certificate. If they sent the server certificate, but you can connect to the server with a browser, you can down load the certificate. If their server is configured to send the server certificate and CA chain, then you can get the entire chain in a single request using "openssl s_client -connect [hostname:port] -showcerts". Save the certs in the console to a file, copying the cert blob(s) to individual cert files (cert1.crt, cert2.crt). However, if they are expecting MTLS and attempting to send a client certificate to you, either you've already generated a private key and CSR (certificate signing request) and send them the CSR. They would have then signed a certificate with their CA certificate using the CSR. The cert they returned would then need to be paired with the private key used to generate the CSR. They should not be generating the public/private key pair and sending them over mail. The private key should be stored security on the one system used to establish the connection. If it's one-way (server ssl only), then your client system (assuming it's not the browser), needs a truststore file, with the CA certificate chain installed and set to trusted. If the platform is Java, read Java's keytool documentation. Note, a keystore is for your systems public/private keypair. A truststore is for the CA certificates that you trust to sign public certificates that your system should trust as being authentic. You need to read any of the PKI x509 overviews by DigiCert, SSLABS, Sectigo, etc.

JMirabile
  • 11
  • 2