Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 7 down vote favorite
2

When I try to use Curl on windows, to retrieve an https url, I get the dreaded "connection error (60)."

enter image description here

The exact error message is:

curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
More details here: http://curl.haxx.se/docs/sslcerts.html

How to resolve this?

share|improve this question
SU doesn't like the word "problem" in the title because it's not descriptive. If you can't figure out a way to re-phrase your title without the word "problem," you're not trying hard enough. :) – Garrett Jun 28 '12 at 21:49
it's an exact quote of the message I'm asking about. I don't want to try to remove that word, it's an important one, for search indexing. – Cheeso Jun 28 '12 at 22:56
@Cheeso: Post contents get indexed as well, someone searching for your question would see it in the description under the title. – Tom Wijsman Sep 22 '12 at 13:47

1 Answer

up vote 6 down vote accepted

I don't know why but I did not find this information all in one place.

  1. Download the SSL-aware version of Curl, or build the SSL-aware version yourself.

  2. From http://curl.haxx.se/docs/caextract.html , Download the cacert.pem file.

  3. Place the curl.exe and the .pem file in the same directory.

  4. Rename the cacert.pem file to curl-ca-bundle.crt

  5. Re-run curl.exe !

EDIT:

There are other ways to solve the problem. this particular way relies on a cacert produced by the maker of Curl. That may not be what you want, and in particular, it may not work for cases where you have a less-than-well-known certifying authority (such as an authority known only to your corporation) for the certificate used by the SSL site. In that case, you will want to generate your own curl-ca-bundle.crt file. You can use certreq.exe and openssl.exe to export such a cert from the IE/Windows store, and then convert-to-pem-format, respectively.

share|improve this answer
1  
Thank you!!! I tried to cURL an HTTPS recently and had a heck of a time trying to figure out how to get it to work. Like you, I too had to check a variety of sources for information, but unfortunately, I did not find the part about having to download the cert file from the cURL site (I saw plenty of stuff about downloading the cert from the target site, but not this). – Synetech Jun 28 '12 at 21:07
Glad it helped. – Cheeso Jun 28 '12 at 21:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.