At our company they enforce a web proxy which breaks SSL connections and replaces the certificate by its own fake certificate. (To be precise it uses a proxy cert which is signed by the company cert.)
In order to download from a https URL I therefore have to make my system trust that fake certificate (or disable certificate checking).
I therefore added both the proxy cert and the company cert to both
/etc/ssl/certs/ca-bundle.crt
and /etc/ssl/certs/ca-certificates.crt
. (Both link to the same file.)
Now downloading with wget
works fine, however downloading with curl
does not work, because curl
is not able to verify the certificate:
* Rebuilt URL to: https://company.net/
* Hostname was NOT found in DNS cache
* Trying 172.18.111.111...
* Connected to 172.18.111.111 (172.18.111.111) port 3128 (#0)
* Establish HTTP proxy tunnel to company.net:443
> CONNECT company.net:443 HTTP/1.1
> Host: company.net:443
> User-Agent: curl/7.39.0
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 200 Connection established
<
* Proxy replied OK to CONNECT request
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-bundle.crt
CApath: none
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS alert, Server hello (2):
* SSL certificate problem: self signed certificate in certificate chain
* Closing connection 0
curl: (60) SSL certificate problem: self signed certificate in certificate chain
What might be wrong? How can I debug further?
Asked by michas
(21862 rep)
Mar 6, 2015, 12:15 PM
Last activity: Apr 23, 2025, 12:02 PM
Last activity: Apr 23, 2025, 12:02 PM