☰

Curl：在 CentOS 7 上使用一些 URL 和最新的 cacert 包时，出现“无法识别对等方的证书颁发者”的错误

tag-icon • tag-icon centos ssl curl
Curl：在 CentOS 7 上使用一些 URL 和最新的 cacert 包时，出现“无法识别对等方的证书颁发者”的错误

Centos 7.6
Curl 7.29

我的应用需要运行来自用户请求的 Curl 请求，但某些 URL 返回curl: (60) Peer's Certificate issuer is not recognized.

到目前为止我已经：

下载了最新的 cacert 包 sudo curl -k https://curl.haxx.se/ca/cacert.pem -o /etc/pki/tls/certs/ca-bundle.crt。

检查已安装的最新软件包： sudo vi /etc/pki/tls/certs/ca-bundle.crt

#
# Bundle of CA Root Certificates
#
# Certificate data from Mozilla as of: Wed Jan 23 04:12:09 2019 GMT
# 
...

运行了一些测试 HTTPS URL，例如 superuser.com，其 curl 没有任何问题。

 curl -v https://superuser.com/questions/1091521/centos-7-wont-accept-any-ssl-certificates

 About to connect() to superuser.com port 443 (#0)
   Trying 151.101.1.69...
 Connected to superuser.com (151.101.1.69) port 443 (#0)
 Initializing NSS with certpath: sql:/etc/pki/nssdb
   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
 SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
 Server certificate:
       subject: CN=*.stackexchange.com,O="Stack Exchange, Inc.",L=New York,ST=NY,C=US
       start date: Oct 05 00:00:00 2018 GMT
       expire date: Aug 14 12:00:00 2019 GMT
       common name: *.stackexchange.com
       issuer: CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US
 GET /questions/1091521/centos-7-wont-accept-any-ssl-certificates HTTP/1.1
 User-Agent: curl/7.29.0
 Host: superuser.com
 Accept: */*

 HTTP/1.1 200 OK
...

然后我测试了几个也使用 HTTPS 的 URL，但返回了curl: (60) Peer's Certificate issuer is not recognized.错误。

curl -v https://www.movistar.com

 About to connect() to www.movistar.com port 443 (#0)
   Trying 194.224.110.42...
 Connected to www.movistar.com (194.224.110.42) port 443 (#0)
 Initializing NSS with certpath: sql:/etc/pki/nssdb
   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
 Server certificate:
       subject: CN=www.movistar.com,O=Telefonica S.A.,L=Madrid,ST=Madrid,C=ES
       start date: Jul 05 12:51:04 2018 GMT
       expire date: Aug 29 09:01:02 2019 GMT
       common name: www.movistar.com
       issuer: CN=GlobalSign Organization Validation CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE
 NSS error -8179 (SEC_ERROR_UNKNOWN_ISSUER)
 Peer's Certificate issuer is not recognized.
 Closing connection 0
curl: (60) Peer's Certificate issuer is not recognized.
More details here: http://curl.haxx.se/docs/sslcerts.html

和


curl -v https://signup.lotro.com

 About to connect() to signup.lotro.com port 443 (#0)
   Trying 198.252.160.63...
 Connected to signup.lotro.com (198.252.160.63) port 443 (#0)
 Initializing NSS with certpath: sql:/etc/pki/nssdb
   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
 Server certificate:
       subject: CN=*.lotro.com,OU=Standing Stone Games LLC,O=Standing Stone Games,L=Needham,ST=ma,C=US
       start date: Mar 12 00:00:00 2018 GMT
       expire date: Mar 20 12:00:00 2019 GMT
       common name: *.lotro.com
       issuer: CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US
 NSS error -8179 (SEC_ERROR_UNKNOWN_ISSUER)
 Peer's Certificate issuer is not recognized.
 Closing connection 0
curl: (60) Peer's Certificate issuer is not recognized.
More details here: http://curl.haxx.se/docs/sslcerts.html

使这些 URL 正常工作的唯一方法是禁用证书验证，例如curl -v --insecure https://signup.lotro.com。

考虑到这些 URL 是来自用户请求的，我怎样才能让这些 URL 进行 curl 而不收到此错误并且不使用该--insecure参数？

注意：我目前正在 Virtual Box VM 中工作，但我的 VPS 上也出现了同样的问题。

superuser.com注 2：请注意和的发行者signup.lotro.com相同，但我只能 curl superuser.com。

答案1

SSLLabs 报告两个都 域显示：

此服务器的证书链不完整

换句话说：服务器配置错误导致了您看到的错误。虽然桌面浏览器会尝试解决此问题，但更简单的工具（例如curldo not）不会。要解决此问题，您需要明确将缺失的 CA 证书添加到您的信任存储中。对于 www.movi​​star.com，这将是GlobalSign 组织验证 CA - SHA256 - G2对于 signup.lotro.com 来说，这将是DigiCert SHA2 高保证服务器 CA。您可以在我提供的链接处下载缺失的 CA 证书作为 PEM，然后将其添加到您的信任存储区，然后使用此信任存储区调用 curl：

$ ( 
  curl https://censys.io/certificates/74ef335e5e18788307fb9d89cb704bec112abd23487dbff41c4ded5070f241d9/pem/raw;
  echo;
  curl https://censys.io/certificates/19400be5b7a31fb733917700789d2f0a2471c0c9d506c0e504c06c16d7cb17c0/pem/raw;
  echo;
  cat /etc/ssl/certs/ca-certificates.crt 
) > myca.pem
$ curl -v --cacert myca.pem https://www.movistar.com

答案2

我这里是在CentOS7，运行pyspider显示错误：

Exception HTTP 599 Peer's certificate issuer has been marked as not trusted by the user

并按照以下步骤进行修复：

更改无效的 libcurl：

/usr/lib64/libcurl.so.4 -> libcurl.so.4.3.0_openssl

有效的 libcurl：

/usr/lib64/libcurl.so.4 -> libcurl.so.4.3.0

并重新安装 pycurl：

pip3 uninstall pycurl
export PYCURL_SSL_LIBRARY=nss
export LDFLAGS=-L/usr/local/opt/openssl/lib;export CPPFLAGS=-I/usr/local/opt/openssl/include;pip install pycurl --compile --no-cache-dir

详细描述参考另一篇 SO 帖子

相关内容