cURL / Mailing Lists / curl-library / Single Mail

curl-library

Re: digging into the tutorial as well as example cacertinmem.c

From: Dennis Clarke <dclarke_at_blastwave.org>
Date: Mon, 11 Mar 2013 22:06:25 -0400

----- Original Message -----
From: Dennis Clarke <dclarke_at_blastwave.org>
Date: Monday, March 11, 2013 9:38 pm
Subject: digging into the tutorial as well as example cacertinmem.c
To: curl-library_at_cool.haxx.se

> I think SSL may be a big baffling to me as the term "CA Cert" gets
> used a lot
> but I am not to clear where libcurl looks to find these CA's.
>
> The sample code cacertinmem.c compiles neatly and I tried to replace the
> contents of the "char * mypem" variable with pem contents I extracted
>
> using openssl :
>
> openssl s_client -connect www.targetsite.com:443 -CApath
> /usr/local/ssl/certs -showcerts
>
> I get lovely looking somewhat like :
>
> CONNECTED(00000004)
> depth=2 O = Entrust.net, OU = www.entrust.net/CPS_2048 incorp. by ref.
> (limits liab.), OU = (c) 1999 Entrust.net Limited, CN = Entrust.net
> Certification Authority (2048)
> verify return:1
> depth=1 C = US, O = "Entrust, Inc.", OU = www.entrust.net/rpa is
> incorporated by reference, OU = "(c) 2009 Entrust, Inc.", CN = Entrust
> Certification Authority - L1C
> verify return:1
> depth=0 C = US, ST = New York, L = New York, O = Some Company Name, CN
> = www.targetsite.com
> verify return:1
>
> So that looks quite nice.
>
> I am thinking, based on the docs for curl_easy_setopt, that I can set
> a filename via CURLOPT_SSLCERT that contains a bundle of PEM data with
> the required PEM goodness
> in it like so :
>
> $ cat
> /usr/local/ssl/certs/Entrust.net_Premium_2048_Secure_Server_CA.pem \
> > /usr/local/ssl/certs/Entrust.net_Secure_Server_CA.pem \
> > /usr/local/ssl/certs/Entrust_Root_Certification_Authority.pem > Entrust_bundle
>
> Then somehow, magically, watch libCurl use that as the place to look
> for a CA Cert.
>
> Am I on the right path here ?

Reply to myself, how stylish.

The curl command line tool verifies that the bundle I made works :

$ curl https://www.targetsite.com --cacert Entrust_bundle 2>&1 | head -5
  % Total % Received % Xferd Average Speed Time Time Time Current
                                 Dload Upload Total Spent Left Speed
100 1656 100 1656 0 0 14211 0 --:--:-- --:--:-- --:--:-- 14526
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>...etc etc etc ..

If I do NOT specify the --cacert filename then I get this :

curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: http://curl.haxx.se/docs/sslcerts.html

No problem.

So I know that my little bundle works.

However when I try to use this :

    curl_easy_setopt ( curl, CURLOPT_CAPATH, "./Entrust_bundle" );

My code still throws : ( with unix time from REALTIME_CLOCK )

 INFO: 1363053559.803122900 : successfully set certificate verify locations:

 INFO: 1363053559.803441850 : CAfile: none
  CApath: ./Entrust_bundle

 INFO: 1363053559.804452922 : SSLv3, TLS handshake, Client hello (1):

TRACE: 1363053559.804765397 : => Send SSL data, 0000000342 bytes (0x00000156)
 INFO: 1363053559.826169037 : SSLv3, TLS handshake, Server hello (2):

TRACE: 1363053559.826480541 : <= Recv SSL data, 0000000049 bytes (0x00000031)
 INFO: 1363053559.827454790 : SSLv3, TLS handshake, CERT (11):

TRACE: 1363053559.827766213 : <= Recv SSL data, 0000002597 bytes (0x00000a25)
 INFO: 1363053559.831700760 : SSLv3, TLS alert, Server hello (2):

TRACE: 1363053559.832011293 : => Send SSL data, 0000000002 bytes (0x00000002)
 INFO: 1363053559.832902911 : SSL certificate problem: unable to get local issuer certificate

 INFO: 1363053559.833269205 : Closing connection 0

curl_easy_perform() failed: Peer certificate cannot be authenticated with given
CA certificates

So I am back to .. wondering .. and reading this again http://curl.haxx.se/docs/sslcerts.html

Anyone see something blatantly obvious ?

dc
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette.html
Received on 2013-03-12