CURL does not recognize certificate

curlhttpsnixosPROXYssl

At our company they enforce a web proxy which breaks SSL connections and replaces the certificate by its own fake certificate. (To be precise it uses a proxy cert which is signed by the company cert.)

In order to download from a https URL I therefore have to make my system trust that fake certificate (or disable certificate checking).

I therefore added both the proxy cert and the company cert to both /etc/ssl/certs/ca-bundle.crt and /etc/ssl/certs/ca-certificates.crt. (Both link to the same file.)

Now downloading with wget works fine, however downloading with curl does not work, because curl is not able to verify the certificate:

* Rebuilt URL to: https://company.net/
* Hostname was NOT found in DNS cache
*   Trying 172.18.111.111...
* Connected to 172.18.111.111 (172.18.111.111) port 3128 (#0)
* Establish HTTP proxy tunnel to company.net:443
> CONNECT company.net:443 HTTP/1.1
> Host: company.net:443
> User-Agent: curl/7.39.0
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 200 Connection established
<
* Proxy replied OK to CONNECT request
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-bundle.crt
  CApath: none
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS alert, Server hello (2):
* SSL certificate problem: self signed certificate in certificate chain
* Closing connection 0
curl: (60) SSL certificate problem: self signed certificate in certificate chain

What might be wrong? How can I debug further?

Best Answer

You need to tell nix about the certs, like so:

security.pki.certificates = [''cert strings go here in PEM format''];

i.e.:

 security.pki.certificates = [
    ''

      -----BEGIN CERTIFICATE-----
<CUT>
      -----END CERTIFICATE-----
    ''
 ];

You can add many of them if you so choose. This will add the included certs to the system cert store, and curl should then use them without any extra command line args.

Related Question