Better late then never :)
For the future generations:
I just encounter (and solved) similar problem. In my case I'm not using self-signed certificate but I thing neither were you.
In cryptography and computer security, a self-signed certificate is a
security certificate that is not signed by a certificate authority
(CA)
Source: https://en.wikipedia.org/wiki/Self-signed_certificate
I think you meant signed by private-CA, which will not be respected out of box by any public OS.
In my case the problem was that the server returned only Intermediate certificate instead of full chain (RootCA was not included), with other servers that are using the same certification but included rootCA both curl
httpie
worked fine.
My problem was like this:
Let my.private.api.net
be a host that returns only Domain certificate my_api.pem
that is signed by Intermediate certificate SubCA.pem
which in turn is signed by RootCA.pem
.
I'm using "raw" ubuntu, i mean nothing was done with CA_BUNDLE etc.
I have both SubCA.pem
and RootCA.pem
files, verifing against RootCA won't work as expected,
this is what happens to me when using SubCA.pem
~> curl https://my.private.api.net --cacert SubCA.pem
OK.
but
~> http https://my.private.api.net --verify SubCA.pem
http: error: SSLError: HTTPSConnectionPool(host='my.private.api.net', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate
verify failed')])"))) while doing a GET request to URL: https://my.private.api.net/
So this does looks like op's case.
As I mentioned before if the admin would change the server setup (to return all certs during handshake) it would fix the problem.
However I found a way to fix this without him. Validating against any of the certs won't work but validating against both will!
What we need is so called "Bundled" certificate, which simply one file with both certs stack on each other, so we create a new file, lets name it Bundled.pem
that looks like this:
-----BEGIN CERTIFICATE-----
<<content from SubCA.pem>>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<<content from RootCA.pem>>
-----END CERTIFICATE-----
order is important!
now httpie
works fine.
~> http https://my.private.api.net --verify Bundled.pem
HTTP/1.1 200 See Other
...
OK.
and so does curl:
~> curl https://my.private.api.net --cacert Bundled.pem
OK.