curl: (60) SSL certificate problem

Yongqiang Cheng

已于 2023-08-20 21:24:03 修改

阅读量1.2w

点赞数 3

分类专栏： 20240202 文章标签： curl SSL certificate

于 2019-07-21 17:00:09 首次发布

世上没有白读的书，每一页都算数。

本文链接：https://blog.csdn.net/chengyq116/article/details/96735861

版权

20240202 专栏收录该内容

116 篇文章 1 订阅

订阅专栏

curl: (60) SSL certificate problem

1. Issues

1.1. curl: (60) server certificate verification failed.

strong@foreverstrong:~/venv/tensorflow_work/fire-detection-cnn$ bash ./download-models.sh 
Downloading pretrained models...

curl: (60) server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.
strong@foreverstrong:~/venv/tensorflow_work/fire-detection-cnn$

1.2. curl: (60) SSL certificate problem: unable to get local issuer certificate

curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.
HTTPS-proxy has similar options --proxy-cacert and --proxy-insecure.

1.3. curl: (60) SSL certificate problem: Invalid certificate chain

curl: (60) SSL certificate problem: Invalid certificate chain
More details here: https://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

1.4. curl: (60) Peer certificate cannot be authenticated with known CA certificates

curl: (60) Peer certificate cannot be authenticated with known CA certificates
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

2. 添加 `-k` 或 `--insecure` 参数来跳过 SSL 证书验证

If you’d like to turn off curl’s verification of the certificate, use the -k (or --insecure) option.
-k, --insecure 指定跳过 SSL 检测，不检查服务器的 SSL 证书是否正确。

yongqiang@yongqiang:~$ man curl

-k, --insecure:
(TLS) By default, every SSL connection curl makes is verified to be secure. This option allows curl to proceed and operate even for server connections otherwise considered insecure.
(TLS) 默认情况下，curl 建立的每个 SSL 连接都经过验证是安全的。即使对于其它被认为不安全的服务器连接，此选项也允许 curl 继续进行和操作。

The server connection is verified by making sure the server’s certificate contains the right name and verifies successfully using the cert store.

yongqiang@yongqiang:~$ curl -k https://www.baidu.com
yongqiang@yongqiang:~$ curl --insecure https://www.baidu.com

2.1. SSL Certificate Verification

https://curl.se/docs/sslcerts.html
SSL is the old name. It is called TLS these days.

Tell libcurl to not verify the peer. With libcurl you disable this with curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, FALSE);

With the curl command line tool, you disable this with -k/--insecure.

################################################################################

# model downloader / unpacker - (c) 2018 Toby Breckon, Durham University, UK

################################################################################

URL_MODELS=https://collections.durham.ac.uk/downloads/r19880vq98m
MODEL_DIR_LOCAL_TARGET=models

MODELS_FILE_NAME=dunnings-2018-fire-detection-pretrained-models.zip
MODELS_DIR_NAME_UNZIPPED=dunnings-2018-fire-detection-pretrained-models
MODELS_MD5_SUM=98815a8594a18f1cafb3e87af8f9b0f1

################################################################################

# set this script to fail on error

set -e

# check for required commands to download and md5 check

(command -v curl | grep curl > /dev/null) ||
  (echo "Error: curl command not found, cannot download!")

(command -v md5sum | grep md5sum > /dev/null) ||
  (echo "Error: md5sum command not found, md5sum check will fail!")

################################################################################

# perform download

echo "Downloading pretrained models..."

mkdir -p $MODEL_DIR_LOCAL_TARGET

MODELS=./$MODEL_DIR_LOCAL_TARGET/$MODELS_FILE_NAME

curl --progress-bar $URL_MODELS > $MODELS -k

################################################################################

# perform md5 check and move to required local target directory

cd $MODEL_DIR_LOCAL_TARGET

echo "checking the MD5 checksum for downloaded models..."

CHECK_SUM_CHECKPOINTS="$MODELS_MD5_SUM  $MODELS_FILE_NAME"

echo $CHECK_SUM_CHECKPOINTS | md5sum -c

echo "Unpacking the zip file..."

unzip -q $MODELS_FILE_NAME

echo "Tidying up..."

mv $MODELS_DIR_NAME_UNZIPPED/* .

rm $MODELS_FILE_NAME && rm -r $MODELS_DIR_NAME_UNZIPPED

cd ..

################################################################################

# tlearn format specific - create checkpoint path files to enable conversion to pb format

echo "model_checkpoint_path: \"firenet\"" > $MODEL_DIR_LOCAL_TARGET/FireNet/checkpoint
echo "all_model_checkpoint_paths: \"firenet\"" >> $MODEL_DIR_LOCAL_TARGET/FireNet/checkpoint

echo "model_checkpoint_path: \"inceptiononv1onfire\"" > $MODEL_DIR_LOCAL_TARGET/InceptionV1-OnFire/checkpoint
echo "all_model_checkpoint_paths: \"inceptiononv1onfire\"" >> $MODEL_DIR_LOCAL_TARGET/InceptionV1-OnFire/checkpoint

echo "model_checkpoint_path: \"sp-inceptionv1onfire\"" > $MODEL_DIR_LOCAL_TARGET/SP-InceptionV1-OnFire/checkpoint
echo "all_model_checkpoint_paths: \"sp-inceptionv1onfire\"" >> $MODEL_DIR_LOCAL_TARGET/SP-InceptionV1-OnFire/checkpoint

################################################################################

echo "... completed -> required models are in $MODEL_DIR_LOCAL_TARGET/"

################################################################################

strong@foreverstrong:~/venv/tensorflow_work/fire-detection-cnn$ bash ./download-models.sh 
Downloading pretrained models...
######################################################################## 100.0%
checking the MD5 checksum for downloaded models...
dunnings-2018-fire-detection-pretrained-models.zip: OK
Unpacking the zip file...
Tidying up...
... completed -> required models are in models/
strong@foreverstrong:~/venv/tensorflow_work/fire-detection-cnn$

3. Updating /etc/ssl/certs

sudo update-ca-certificates

strong@foreverstrong:~/venv/tensorflow_work/fire-detection-cnn$ sudo update-ca-certificates
[sudo] password for strong: 
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...

done.
done.
strong@foreverstrong:~/venv/tensorflow_work/fire-detection-cnn$ 
strong@foreverstrong:~/venv/tensorflow_work/fire-detection-cnn$ bash ./download-models.sh
......

date / date -R
检查你的系统时钟，date / date -R。如果不正确，证书检查将失败。

strong@foreverstrong:~$ date
Sun Jul 21 16:53:57 CST 2019
strong@foreverstrong:~$ 
strong@foreverstrong:~$ date -R
Sun, 21 Jul 2019 16:55:09 +0800
strong@foreverstrong:~$

4. `export GIT_SSL_NO_VERIFY=1`

关闭系统的安全认证，然后再次下载。

export GIT_SSL_NO_VERIFY=1
or
git config --global http.sslverify false

strong@foreverstrong:~/venv/tensorflow_work/fire-detection-cnn$ export GIT_SSL_NO_VERIFY=1
strong@foreverstrong:~/venv/tensorflow_work/fire-detection-cnn$ 
strong@foreverstrong:~/venv/tensorflow_work/fire-detection-cnn$ bash ./download-models.sh
......