Forum Discussion

Amarz_274415's avatar
Amarz_274415
Icon for Nimbostratus rankNimbostratus
Mar 18, 2018

SSL Certificate verify result

I changed the CA from symantec to Entrust, and after updating the URL certs to the new one, when i run the curl "curl -k -vv IP:443" command to verify the ssl status, it give this error

 

SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.

 

earlier it used to say SSL verify OK or something. can someone throw some light on this for my understanding?

 

regards, Amarz

 

application delivery
LTM
security
  • Surgeon's avatar
    Surgeon
    Ret. Employee
    Mar 18, 2018

    curl has no build CAs database as browsers have. Because of that you are getting the error but since you used -k key it allows curl to proceed further.

     

    If you want to use CA cert to verify server's cert then you can use --cacert/--capath

     

  • Samir_Jha_52506's avatar
    Samir_Jha_52506
    Icon for Noctilucent rankNoctilucent
    Mar 18, 2018

    @Amarz, Seems you are running this command on local system, where curl has install but system is not giving CA-bundle cert to verify. Generally in F5 it store "CAfile: /etc/pki/tls/certs/****"

    Error: unable to get local issuer certificate (20), continuing anyway.

    I would recommend you to run curl command on LB device device, where CA-bundle is available. Small modification require in command.

            curl -k -vv https://

    let us know if any question.