curl:(60) SSL证书问题:无法获得本地颁发者证书

root@sclrdev:/home/sclr/certs/FreshCerts# curl --ftp-ssl --verbose ftp://{abc}/ -u trup:trup --cacert /etc/ssl/certs/ca-certificates.crt
* About to connect() to {abc} port 21 (#0)
*   Trying {abc}...
* Connected to {abc} ({abc}) port 21 (#0)
< 220-Cerberus FTP Server - Home Edition
< 220-This is the UNLICENSED Home Edition and may be used for home, personal use only
< 220-Welcome to Cerberus FTP Server
< 220 Created by Cerberus, LLC
> AUTH SSL
< 234 Authentication method accepted
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS alert, Server hello (2):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

当前回答

在所有的ca中，我对Digicert有这个问题。我创建了一个数字文件。Pem文件，只是中间和根粘贴到一个文件。

curl https://cacerts.digicert.com/DigiCertGlobalRootCA.crt.pem
curl https://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt.pem

curl -v https://mydigisite.com/sign_on --cacert DigiCertCA.pem
...
*  subjectAltName: host "mydigisite.com" matched cert's "mydigisite.com"
*  issuer: C=US; O=DigiCert Inc; CN=DigiCert SHA2 Secure Server CA
*  SSL certificate verify ok.
> GET /users/sign_in HTTP/1.1
> Host: mydigisite.com
> User-Agent: curl/7.65.1
> Accept: */*
...

Eorekan有答案，但只有我和另一个人对他的答案进行了投票。

2020-06-01 19:12:07

其他回答

在windows上-如果你想从cmd运行

> curl -X GET "https://some.place"

下载cacert。pem从 https://curl.haxx.se/docs/caextract.html

永久设置环境变量:

CURL_CA_BUNDLE = C:\somefolder\cacert.pem

并通过重新打开任何您想要的cmd窗口来重新加载环境使用旋度;如果安装了Chocolatey，您可以使用:

refreshenv

现在再试一次

故障原因: https://laracasts.com/discuss/channels/general-discussion/curl-error-60-ssl-certificate-problem-unable-to-get-local-issuer-certificate/replies/95548

2017-12-07 21:11:17

简单的解决方案: 在~ /。Sdkman /etc/config, change sdkman_insecure_ssl=true

步骤: 纳米~ / .sdkman / etc /配置将sdkman_insecure_ssl=false修改为sdkman_insecure_ssl=true 保存并退出

2015-11-05 16:43:58

在亚马逊Linux (CentOS / Red Hat等)上，我做了以下工作来解决这个问题。首先复制cacert。Pem从http://curl.haxx.se/ca/cacert.pem下载，放在/etc/pki/ca-trust/source/anchors/目录下。执行update-ca-trust命令。

下面是来自https://serverfault.com/questions/394815/how-to-update-curl-ca-bundle-on-redhat的一句话

Curl https://curl.se/ca/cacert.pem -o /etc/pki/ca-trust/source/anchors/curl-cacert-updated。Pem && update-ca-trust

然而，由于curl被破坏，我实际上使用这个命令来下载cacert。pem文件。

Wget——no-check-certificate http://curl.haxx.se/ca/cacert.pem

另外，如果你在使用php时遇到了问题，你可能需要重新启动你的web服务器服务httpd restart for apache或service nginx restart for nginx。

2021-10-13 20:31:19

有这个问题，但新版本没有解决。/etc/certs有根证书，浏览器说一切正常。经过一些测试后，我从ssllabs.com得到警告，我的链是不完整的(实际上这是旧证书链，而不是新证书链)。在纠正了证书链之后，一切都很好，即使是curl。

2019-07-05 14:04:41

对我来说，简单地安装证书有帮助:

sudo apt-get install ca-certificates

2018-04-02 15:46:55

curl:(60) SSL证书问题:无法获得本地颁发者证书

推荐文章

最新文章

标签