root@sclrdev:/home/sclr/certs/FreshCerts# curl --ftp-ssl --verbose ftp://{abc}/ -u trup:trup --cacert /etc/ssl/certs/ca-certificates.crt
* About to connect() to {abc} port 21 (#0)
* Trying {abc}...
* Connected to {abc} ({abc}) port 21 (#0)
< 220-Cerberus FTP Server - Home Edition
< 220-This is the UNLICENSED Home Edition and may be used for home, personal use only
< 220-Welcome to Cerberus FTP Server
< 220 Created by Cerberus, LLC
> AUTH SSL
< 234 Authentication method accepted
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS alert, Server hello (2):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
当前回答
我通过在cURL脚本中添加一行代码解决了这个问题:
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
警告:这使得请求绝对不安全(参见@YSU的回答)!
其他回答
我在Wordpress安装上试图通过ElasticPress和AWS ACM PCA管理的自签名根CA与内部ElasticSearch服务通信,已经为这个问题困扰了几天。
在我的特殊情况下,我从默认的cURL传输以及预期的正文中收到了200 OK响应,但Wordpress返回了一个WP_Error对象,ElasticPress由于这个证书问题而获得,但从未记录。
说到Wordpress,有两件事值得注意:
The default cURL Transport for all wp_remote_* calls will look to a CA Bundle located in wp-includes/certificates/ca-bundle.crt. This bundle serves largely the same purpose as what's found under https://curl.haxx.se/docs/caextract.html, and will cover most use-cases that don't typically involve more exotic setups. Action/Filter order matters in Wordpress, and in ElasticPress' case, many of its own internal functions leverage these remote calls. The problem is, these remote calls were being executed during the plugins_loaded lifecycle, which is too early for Theme logic to be able to override. If you're using any plugins that make external calls out to other services and you need to be able to modify the requests, you should take careful note as to WHEN these plugins are performing these requests.
这意味着,即使在主题中定义了正确的服务器设置、钩子、回调和逻辑,你仍然可能以一个坏的设置结束,因为底层插件调用在主题加载之前执行得很好,并且永远无法告诉Wordpress关于新证书的信息。
在Wordpress应用程序中,我知道只有两种方法可以在不更新核心或第三方代码逻辑的情况下规避这个问题:
(推荐)添加一个“必须使用”插件到您的安装,调整您需要的设置。MU插件是Wordpress生命周期中最早加载的,可以让你在不直接改变它们的情况下覆盖你的插件和核心。在我的例子中,我用下面的逻辑建立了一个简单的MU插件:
// ep_pre_request_args is an ElasticPress-specific call that we need to adjust for all outbound HTTP requests
add_filter('ep_pre_request_args', function($args){
if($_ENV['ELASTICSEARCH_SSL_PATH'] ?? false) {
$args['sslcertificates'] = $_ENV['ELASTICSEARCH_SSL_PATH'];
}
return $args;
});
(不推荐)如果你实在没有其他选择,你也可以将根CA附加到wp-includes/certificates/ CA -bundle.crt。这似乎会“纠正”潜在的问题,你将得到正确的SSL证书验证,但这种方法将失败每次更新Wordpress,除非你添加额外的自动化。
我添加这个答案是因为在我甚至懒得深入研究插件源代码之前,我已经认为我在我的设置中做了一些错误或不稳定的事情。希望这可以为正在做类似事情的人节省一些时间。
它失败了,因为cURL无法验证服务器提供的证书。
有两个选项可以让它工作:
使用带-k选项的cURL,允许cURL建立不安全的连接,即cURL不验证证书。 将根CA(签署服务器证书的CA)添加到/etc/ssl/certs/ca-certificates.crt
您应该使用选项2,因为它是确保您连接到安全FTP服务器的选项。
在windows上-如果你想从cmd运行
> curl -X GET "https://some.place"
下载cacert。pem从 https://curl.haxx.se/docs/caextract.html
永久设置环境变量:
CURL_CA_BUNDLE = C:\somefolder\cacert.pem
并通过重新打开任何您想要的cmd窗口来重新加载环境 使用旋度;如果安装了Chocolatey,您可以使用:
refreshenv
现在再试一次
故障原因: https://laracasts.com/discuss/channels/general-discussion/curl-error-60-ssl-certificate-problem-unable-to-get-local-issuer-certificate/replies/95548
在窗户上我遇到了这个问题。Curl是由mysysgit安装的,所以下载并安装最新版本可以解决我的问题。
否则,这些是关于如何更新您的CA证书的不错的说明,您可以尝试。
我也遇到过这个问题。我读了这篇文章,大部分答案都很有信息量,但对我来说太复杂了。我在社交话题上没有经验,所以这个答案适合像我这样的人。
在我的例子中,发生这个错误是因为我没有在应用程序中使用的证书旁边包含中间证书和根证书。
以下是我从SSL证书供应商那里得到的信息:
- abc.crt
- abc.pem
- abc-bunde.crt
在abc。CRT文件,只有一个证书:
-----BEGIN CERTIFICATE-----
/*certificate content here*/
-----END CERTIFICATE-----
如果我以这种格式提供它,浏览器将不会显示任何错误(Firefox),但我会得到curl:(60) SSL证书:无法获得本地颁发者证书错误时,我做curl请求。
要修复此错误,请检查abc-bunde。crt文件。你很可能会看到这样的东西:
-----BEGIN CERTIFICATE-----
/*additional certificate content here*/
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
/*other certificate content here*/
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
/*different certificate content here*/
-----END CERTIFICATE-----
这些是您的中级证书和根证书。发生错误是因为您提供给应用程序的SSL证书中缺少它们。
要修复此错误,请以以下格式合并这两个文件的内容:
-----BEGIN CERTIFICATE-----
/*certificate content here*/
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
/*additional certificate content here*/
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
/*other certificate content here*/
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
/*different certificate content here*/
-----END CERTIFICATE-----
请注意,证书之间、文件的末尾或开头没有空格。一旦您向应用程序提供了这个组合证书,您的问题就会得到解决。
推荐文章
- 如何在PHP中捕获cURL错误
- CFNetwork SSLHandshake iOS 9失败
- 加载资源:net::ERR_INSECURE_RESPONSE失败
- 无法在Windows上从/usr/local/ssl/openssl.cnf加载配置信息
- 在Bash中将输出赋给变量
- HTTPS和SSL3_GET_SERVER_CERTIFICATE:证书验证失败,CA is OK
- c#忽略证书错误?
- 如何允许本地主机上的Apache使用HTTPS ?
- 如何在Node.js内进行远程REST调用?旋度吗?
- 配置Git接受特定https远程的特定自签名服务器证书
- CMake无法找到OpenSSL库
- 如何为已安装的Ubuntu LAMP堆栈启用cURL ?
- 从PKCS12文件中提取公钥/私钥,供以后在SSH-PK-Authentication中使用
- PHP获取网站URL协议- http vs https
- 为什么cURL返回错误“(23)Failed writing body”?