I've set up a server using Jetty and SSL. I am using a self-signed server certificate for the client and server. This all works fine when I try to hit it with wget. My problem comes when I'm trying to hit it using curl:

$ curl -k --cert ./mycert-001.pem --key ./mykey-001.pem https://****:9994/rest/list --verbose
* About to connect() to server port 9994 (#0)
*   Trying ****...
* Connected to server(****) port 9994 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* skipping SSL peer certificate verification
* NSS: client certificate from file
*       subject: CN=foo,OU=bar,O=baz,L=Default City,C=US
*       start date: Nov 29 18:50:58 2016 GMT
*       expire date: Nov 29 18:50:58 2019 GMT
*       common name: foo
*       issuer: CN=foo,OU=bar,O=baz,L=Default City,C=US
Segmentation fault

Then when I try with wget:

$ wget --certificate=mycert-001.pem --private-key=mykey-001.pem --no-check-certificate --auth-no-challenge https://****:9994/rest/list
--2017-04-14 15:50:20--  https://****:9994/rest/list
Resolving **** (****)... *****
Connecting to ***** (****)|****|:9994... connected.
WARNING: cannot verify ****'s certificate, issued by ‘/C=US/ST=FOO/L=Default/O=FOO/OU=FOO/CN=FOO’:
  Self-signed certificate encountered.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/json]
Saving to: ‘list.5’

    [ <=>                                                  ] 58          --.-K/s   in 0s

2017-04-14 15:50:20 (3.47 MB/s) - ‘list.5’ saved [58]

Am I missing an option on curl to get this to work?

up vote 0 down vote accepted

A core program like curl should never just crash as expected behavior. You've hit a bug.

Things you can try (this is now a troubleshooting question):

  • Try updating your distro packages (apt update && apt full-upgrade, or your distro equivalent since you didn't say what distro/version you're using)
  • Try upgrading your distro to a newer release
  • Look for alternative packages that have curl compiled against a different TLS library than NSS (maybe OpenSSL, PolarSSL, or GnuTLS)
  • Compile a new version of curl yourself
  • Look for a container image of a newer OS or grab a Flatpak with a different version of curl or compiled with a different TLS library

...etc.

  • Forgot to update this: I ended up compiling curl with a OpenSSL as you suggested and it ended up working. Thank you. – nad Jul 13 '17 at 15:55

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.