Curl SSL verify error

[awsl]

But,I've told curl where is the ca-cert file.

@awsl

sudo curl -kvslI https://ssl.othing.xyz --cacert /etc/ssl/certs/ca-certificates.crt

curl -vsI https://...... Just works.Even if not specified --cacert

curl -kvsI https://...... Not works. Whether specified --cacert or not, it always says * SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.

[rg305]

Maybe order matters...
Change:
sudo curl -kvslI https://ssl.othing.xyz --cacert /etc/ssl/certs/ca-certificates.crt
to
sudo curl --cacert /etc/ssl/certs/ca-certificates.crt -kvslI https://ssl.othing.xyz

Also, my apologies for having forgotten what was posted seven days ago

[rg305]

If that fails...
Try:

Install cURL on Manjaro Linux using the Snap Store | Snapcraft

[awsl]

@rg305

sudo curl --cacert /etc/ssl/certs/ca-certificates.crt -kvslI https://ssl.othing.xyz

Not working. Maybe I need to go to the manjaro forum for help

[awsl]

Snap is ugly. What's more, I can't connect to Snap due to ISP ban, and it has no mirroring, so I can't try this method. Thanks also for your help!

[awsl]

My ubuntu 20.04 virtual machine cannot reproduce the problem. So it seems to be a problem with manjaro or curl. I opened a new thread Curl SSL verify error - Software & Applications - Manjaro Linux Forum

[awsl]

Curl SSL verify error

Do not use the -k option. With -k , no check is done and no cert store is loaded. If you want to verify a cert you can’t use -k .

openssl: if verifypeer is not requested, skip the CA loading

[MikeMcQ]

So, was the problem that curl 7.80 now always shows this message when using -k?

***  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.**

Do your original commands work without -k?

[awsl]

There's no error without -k.
If add -k ,even digicert.com will show the same error

• issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=DigiCert SHA2 Extended Validation Server CA
• SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.

[MikeMcQ]

Oh, ok. Thanks for clarifying. A poorly worded message to confirm -k which means to skip the verify result. And, they now don't load the CA file for -k so of course no local certs would be found. Huh.

[rg305]

@awsl

Do not use the -k option. With -k , no check is done and no cert store is loaded. If you want to verify a cert you can’t use -k.

A very strange behavior - but who are we to dampen progress/change!

[HardcoreGames]

That is curious as SNAP works on my ISP fine. Not that I used it much outside of installing some tools.