root@sclrdev:/home/sclr/certs/FreshCerts# curl --ftp-ssl --verbose ftp://{abc}/ -u trup:trup --cacert /etc/ssl/certs/ca-certificates.crt
* About to connect() to {abc} port 21 (#0)
* Trying {abc}...
* Connected to {abc} ({abc}) port 21 (#0)
< 220-Cerberus FTP Server - Home Edition
< 220-This is the UNLICENSED Home Edition and may be used for home, personal use only
< 220-Welcome to Cerberus FTP Server
< 220 Created by Cerberus, LLC
> AUTH SSL
< 234 Authentication method accepted
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS alert, Server hello (2):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
当前回答
仅仅更新证书列表可能就足够了
sudo update-ca-certificates -f
update-ca-certificates是一个更新/etc/ssl/certs目录以保存SSL证书并生成ca-certificates的程序。Crt,一个连接的证书单文件列表。
其他回答
我在Wordpress安装上试图通过ElasticPress和AWS ACM PCA管理的自签名根CA与内部ElasticSearch服务通信,已经为这个问题困扰了几天。
在我的特殊情况下,我从默认的cURL传输以及预期的正文中收到了200 OK响应,但Wordpress返回了一个WP_Error对象,ElasticPress由于这个证书问题而获得,但从未记录。
说到Wordpress,有两件事值得注意:
The default cURL Transport for all wp_remote_* calls will look to a CA Bundle located in wp-includes/certificates/ca-bundle.crt. This bundle serves largely the same purpose as what's found under https://curl.haxx.se/docs/caextract.html, and will cover most use-cases that don't typically involve more exotic setups. Action/Filter order matters in Wordpress, and in ElasticPress' case, many of its own internal functions leverage these remote calls. The problem is, these remote calls were being executed during the plugins_loaded lifecycle, which is too early for Theme logic to be able to override. If you're using any plugins that make external calls out to other services and you need to be able to modify the requests, you should take careful note as to WHEN these plugins are performing these requests.
这意味着,即使在主题中定义了正确的服务器设置、钩子、回调和逻辑,你仍然可能以一个坏的设置结束,因为底层插件调用在主题加载之前执行得很好,并且永远无法告诉Wordpress关于新证书的信息。
在Wordpress应用程序中,我知道只有两种方法可以在不更新核心或第三方代码逻辑的情况下规避这个问题:
(推荐)添加一个“必须使用”插件到您的安装,调整您需要的设置。MU插件是Wordpress生命周期中最早加载的,可以让你在不直接改变它们的情况下覆盖你的插件和核心。在我的例子中,我用下面的逻辑建立了一个简单的MU插件:
// ep_pre_request_args is an ElasticPress-specific call that we need to adjust for all outbound HTTP requests
add_filter('ep_pre_request_args', function($args){
if($_ENV['ELASTICSEARCH_SSL_PATH'] ?? false) {
$args['sslcertificates'] = $_ENV['ELASTICSEARCH_SSL_PATH'];
}
return $args;
});
(不推荐)如果你实在没有其他选择,你也可以将根CA附加到wp-includes/certificates/ CA -bundle.crt。这似乎会“纠正”潜在的问题,你将得到正确的SSL证书验证,但这种方法将失败每次更新Wordpress,除非你添加额外的自动化。
我添加这个答案是因为在我甚至懒得深入研究插件源代码之前,我已经认为我在我的设置中做了一些错误或不稳定的事情。希望这可以为正在做类似事情的人节省一些时间。
简单的解决方案: 在~ /。Sdkman /etc/config, change sdkman_insecure_ssl=true
步骤: 纳米~ / .sdkman / etc /配置 将sdkman_insecure_ssl=false修改为sdkman_insecure_ssl=true 保存并退出
由于conda环境,一些系统可能存在此问题。如果你安装了conda,那么禁用它可以解决你的问题。在我的情况下,当我停用conda时,这个curl-SSL错误得到了解决。在ubuntu或MacOS上试试这个命令
conda deactivate
这可以帮助你控制暴饮暴食:
$client = new Client(env('API_HOST'));
$client->setSslVerification(false);
测试在guzzle/guzzle 3.*
我本想评论Yuvik的回答,但我缺乏足够的声誉点。
当您将.crt文件导入到/usr/share/local/ca-certificates时,需要使用正确的格式。其中一些已经在前面提到过,但是还没有人提到只需要一个新的行字符,也没有人收集过清单,所以我想在这里提供一个清单。
The certificate needs to end in .crt. From Ubuntu's man page: Certificates must have a .crt extension in order to be included by update-ca-certificates Certificate files in /usr/local/share/ca-certificates can only contain one certificate Certificate files must end in a newline. update-ca-certificates will appear to work if each row contains, for example, a carriage return + a newline (as is standard in Windows), but once the certificate is appended to /etc/ssl/ca-certificates.crt, it still will not work. This specific requirement bit me as we're loading certificates from an external source.
推荐文章
- 证书验证失败:无法获得本地颁发者证书
- 当使用pip3安装包时,“Python中的ssl模块不可用”
- 如何在PHP中捕获cURL错误
- CFNetwork SSLHandshake iOS 9失败
- 加载资源:net::ERR_INSECURE_RESPONSE失败
- 无法在Windows上从/usr/local/ssl/openssl.cnf加载配置信息
- 在Bash中将输出赋给变量
- HTTPS和SSL3_GET_SERVER_CERTIFICATE:证书验证失败,CA is OK
- c#忽略证书错误?
- 如何允许本地主机上的Apache使用HTTPS ?
- 如何在Node.js内进行远程REST调用?旋度吗?
- 配置Git接受特定https远程的特定自签名服务器证书
- CMake无法找到OpenSSL库
- 如何为已安装的Ubuntu LAMP堆栈启用cURL ?
- 从PKCS12文件中提取公钥/私钥,供以后在SSH-PK-Authentication中使用