Ssl issue with curl 7.52.1 version

Help
1

Hi,

We are facing an issue related to ssl on our test devices. Same thing is working perfectly on my local machine.

Please help me out, how I can resolve this issue without update anything in the device.

Command:
curl https://test-domain.com

Output:

More details here: https://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

Device curl version: 7.52.1
Location Machine curl version: 8.6.0
Server certbot version: 0.31.0

2

@ramaiahkethana , welcome to the community!

You may analyze the output of the

openssl s_client -connect test-domain.com:443 -showcerts

command.

3 Likes
3

What operating system are the devices running? Because that domain is using an ECDSA certificate along with the ecdsa chain to the ISRG Root X2. Any device must be modern enough to have that root in its CA certificate store.

If they don't you might change your server to use an RSA certificate or an account that is not on the ECDSA allow list

3 Likes
4

Hi @MikeMcQ,

Thanks for the reply

The device I am testing is not supporting ECDSA based certificates. Do you have any idea how to install rsa based certificates using certbot in the server?

1 Like
5

curl uses backend ssl lib like openssl/wolfssl/mbedtls: may I ask what it uses?

4 Likes
6

That version of Certbot defaults to issuing RSA certs. You would have had to explicitly request the ECDSA cert so just don't do that.

You haven't described your server so hard to give specific advice. I couldn't learn what kind of server from its HTTP response headers either.

Do you control that domain name and server? Because it looks like it might be a parking page.

Is test-domain.com your actual domain?

4 Likes
7

What shows?:
certbot certificates

3 Likes