5

when using curl in verbose mode, I get this error: Command:

$ curl -vvI https://www.google.com

Error:

  • successfully set certificate verify locations:
  • CAfile: none CApath: /etc/ssl/certs
  • TLSv1.3 (OUT), TLS handshake, Client hello (1):
  • TLSv1.3 (IN), TLS handshake, Server hello (2):
  • TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
  • TLSv1.3 (IN), TLS handshake, Certificate (11):
  • TLSv1.3 (OUT), TLS alert, unknown CA (560):
  • SSL certificate problem: unable to get local issuer certificate
  • Closing connection 0

But if I send the same command with sudo, the connection is setup successfully, so I guess it's a permission issue.

This is what I get with namei command:

$ namei -mo /etc/ssl/certs/ca-certificates.crt f: /etc/ssl/certs/ca-certificates.crt drwxr-xr-x root root / drwxr-xr-x root root etc drwxr-xr-x root root ssl drw-r--r-- root root certs ca-certificates.crt - Permission denied

So I issued this command:

$ sudo chmod 755 /etc/ssl/certs/ca-certificates.crt

That was executed without errors, but the output of namei command is the same.

Same thing with /etc/ssl/certs/certificate.crt

Finally, if I send this command:

$ sudo ls -l /etc/ssl/certs/ca-certificates.crt

I get:

-rwxr-xr-x 1 root root 218664 lug 19 18:51 /etc/ssl/certs/ca-certificates.crt
Improve this question

3 Answers 3

Reset to default
3

You can't access files in the /etc/ssl/certs directory because it is missing search permission (x). You may fix that with chmod, e.g.: chmod a+x /etc/ssl/certs

Improve this answer
0

As you have seen, you can't access ca-certificates.crt. The curl command tries to access the certificate bundle with your user, but fails. You can fix this by using chmod. 755 may be used in this case, as certificate bundles are not sensitive files.

Improve this answer
1
  • Sorry to not have mentioned this before... I edit my question Commented Jul 25, 2021 at 9:07
0

when i see But if I send the same command with sudo, the connection is setup successfully, i think it`s the same issue. check more with the link.

rm "$(brew --prefix)"/etc/{openssl@{1.1,3},ca-certificates}/cert.pem brew reinstall ca-certificates brew postinstall openssl@{1.1,3}
Improve this answer
1
  • This is a debian issue, not macOS, though I am aware Homebrew is also present on other nixes. Commented May 5 at 9:05

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.