Package: curl Version: 7.21.6-1 Severity: normal The default certificates are ignored when the --capath option is used (either as a command-line argument or in the .curlrc file). I wonder whether this is intentional, but the status of default certificates is not documented in the curl(1) man page.
For instance: ypig:~> curl --capath ~/wd/config/cacert https://bugs.freedesktop.org/ curl: (60) SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed More details here: http://curl.haxx.se/docs/sslcerts.html curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option. If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL). If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option. Moreover this seems to be a Debian-specific bug, as I don't have this problem under Mac OS X (with the same contents of ~/wd/config/cacert). It seems that one can use several directories separated by a ":", but this is not documented in the man page. If this is a real feature, the only (minor) problem is that one needs to know what is the default path. An additional feature could be to prepend or append the default path when the user capath starts or ends with ":". -- System Information: Debian Release: wheezy/sid APT prefers unstable APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 2.6.39-1-amd64 (SMP w/8 CPU cores) Locale: LANG=POSIX, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages curl depends on: ii libc6 2.13-4 Embedded GNU C Library: Shared lib ii libcurl3 7.21.6-1 Multi-protocol file transfer libra ii zlib1g 1:1.2.3.4.dfsg-3 compression library - runtime curl recommends no packages. curl suggests no packages. -- no debconf information -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
