root@sclrdev:/home/sclr/certs/FreshCerts# curl --ftp-ssl --verbose ftp://{abc}/ -u trup:trup --cacert /etc/ssl/certs/ca-certificates.crt
* About to connect() to {abc} port 21 (#0)
* Trying {abc}...
* Connected to {abc} ({abc}) port 21 (#0)
< 220-Cerberus FTP Server - Home Edition
< 220-This is the UNLICENSED Home Edition and may be used for home, personal use only
< 220-Welcome to Cerberus FTP Server
< 220 Created by Cerberus, LLC
> AUTH SSL
< 234 Authentication method accepted
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS alert, Server hello (2):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
当前回答
这可以帮助你控制暴饮暴食:
$client = new Client(env('API_HOST'));
$client->setSslVerification(false);
测试在guzzle/guzzle 3.*
其他回答
我本想评论Yuvik的回答,但我缺乏足够的声誉点。
当您将.crt文件导入到/usr/share/local/ca-certificates时,需要使用正确的格式。其中一些已经在前面提到过,但是还没有人提到只需要一个新的行字符,也没有人收集过清单,所以我想在这里提供一个清单。
The certificate needs to end in .crt. From Ubuntu's man page: Certificates must have a .crt extension in order to be included by update-ca-certificates Certificate files in /usr/local/share/ca-certificates can only contain one certificate Certificate files must end in a newline. update-ca-certificates will appear to work if each row contains, for example, a carriage return + a newline (as is standard in Windows), but once the certificate is appended to /etc/ssl/ca-certificates.crt, it still will not work. This specific requirement bit me as we're loading certificates from an external source.
我的情况不同。我在防火墙后面托管一个网站。错误是由pfSense引起的。
Network layout: |Web Server 10.x.x.x| <-> |pfSense 49.x.x.x| <-> |Open Internet|
多亏了这个答案,我意外地找到了原因。
当我从广域网访问我的网站时,一切都很好。
然而,当从局域网内访问站点时(例如,当Wordpress向其自己的服务器发出curl请求时,尽管使用WAN IP 49.x.x.x),它被提供pfSense登录页面。
我将证书标识为pfSense webConfigurator自签名证书。难怪curl抛出一个错误。
原因:发生的事情是curl正在使用站点的WAN IP地址49.x.x.x。但是,在web服务器的上下文中,广域网IP是防火墙。
调试:我发现我正在获得pfSense证书。
解决方案:在托管该站点的服务器上,将其自己的域名指向127.0.0.1
通过应用该解决方案,web服务器正确地处理了curl的请求,并且没有转发到防火墙,防火墙通过发送登录页面进行响应。
这是ssh证书存储问题。请先从目标CA网站下载有效的证书pem文件,再构建软链接文件指示ssl信任证书。
openssl x509 -hash -noout -in DigiCert_Global_Root_G3.pem
您将得到dd8e9d41
使用散列号构建solf链接,并以.0(点- 0)作为文件后缀
DD8E9D41.0
然后再试一次。
根据cURL文档,您还可以将证书传递给cURL命令:
获取可以验证远程服务器的CA证书并使用 适当的选项指出此CA证书进行验证时 连接。对于libcurl黑客:curl_easy_setopt(curl, CURLOPT_CAPATH capath); 使用curl命令行工具:——cacert[文件]
例如:
curl --cacert mycertificate.cer -v https://www.stackoverflow.com
我的方法是在旋度上加-k。 没必要把事情复杂化。
卷曲人:/ d.el。B /release/curl/date 1.20.0/binus/lynx / 64/ cubacal
推荐文章
- 我需要做什么才能使ie8接受自签署证书?
- 使用请求包时出现SSL InsecurePlatform错误
- BEGIN RSA PRIVATE KEY与BEGIN PRIVATE KEY的区别
- 从URL执行bash脚本
- 你从哪里包含jQuery库?谷歌JSAPI吗?CDN吗?
- Ruby Bundle Symbol not found: _SSLv2_client_method (LoadError)
- PHP中的cURL是什么?
- 错误:无法验证nodejs中的第一个证书
- 对bash脚本函数中定义的变量使用curl POST
- 没有为Android SSL连接找到信任锚
- 抓取:SSL: CERTIFICATE_VERIFY_FAILED错误http://en.wikipedia.org
- 使用curl POST multipart/form-data的正确方法是什么?
- 使用.htaccess和mod_rewrite强制SSL/https
- PHP -调试Curl
- (1) libcurl不支持或禁用https协议