I am running curl against a sni-enabled server with the following command
curl --cacert CustomCA.crt -H "Host: example.com" https://220.127.116.11/foo
However, I am not getting the right certificate where common name (CN) set as example.com (hence the certificate verification failed). I know the SNI config is done correctly because I see the right certificate is delivered when accessing it through web browser. Just in case, my current environment is
> curl --version curl 7.35.0 (x86_64-pc-linux-gnu) libcurl/7.35.0 OpenSSL/1.0.1f zlib/1.2.8 libidn/1.28 librtmp/2.3 Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp smtp smtps telnet tftp Features: AsynchDNS GSS-Negotiate IDN IPv6 Largefile NTLM NTLM_WB SSL libz TLS-SRP > lsb_release -a LSB Version: core-2.0-amd64:core-2.0-noarch:core-3.0-amd64:core-3.0-noarch:core-3.1-amd64:core-3.1-noarch:core-3.2-amd64:core-3.2-noarch:core-4.0-amd64:core-4.0-noarch:core-4.1-amd64:core-4.1-noarch:security-4.0-amd64:security-4.0-noarch:security-4.1-amd64:security-4.1-noarch Distributor ID: Ubuntu Description: Ubuntu 14.04.1 LTS Release: 14.04 Codename: trusty
EDIT: I forgot to mention that there is no dns entry to map example.com to 18.104.22.168. This is actually a part of my work, which I did it in ruby as follows:
context = OpenSSL::SSL::SSLContext.new context.ca_file = 'CustomCA.crt' context.verify_mode = OpenSSL::SSL::VERIFY_PEER tcp_client = TCPSocket.new('22.214.171.124', 443) ssl_client = OpenSSL::SSL::SSLSocket.new(tcp_client, context) ssl_client.hostname = 'example.com' ssl_client.connect cert = OpenSSL::X509::Certificate.new(ssl_client.peer_cert) cert_ca = OpenSSL::X509::Certificate.new(File.read(ca_path)) ssl_client.sysclose tcp_client.close
I am just wondering how to re-create something like this by just using curl.
And... by editing my own copy of /etc/hosts, the command would work properly
why is that?
EDIT 2: doing it via openssl
openssl s_client -connect 126.96.36.199:443 -servername example.com