Discussion:
How to use curl with nss supported?
张绪峰
2010-12-09 07:47:21 UTC
Permalink
Hi All,

I have some problems with curl+nss usage.

Version
--------------
$ curl -V
curl 7.20.0 (i686-target-linux-gnu) libcurl/7.20.0 NSS/3.12.4.5 zlib/1.2.5 libidn/0.6.5
Protocols: dict file ftp ftps http https imap imaps pop3 pop3s rtsp smtp smtps telnet tftp
Features: IDN IPv6 Largefile SSL libz
---------------
NSS database is in '/etc/pki/nssdb' directory.
When I run certutil, the output is:
$ certutil -L -d /etc/pki/nssdb/
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
I don't know why there is no nickname output.
I also find there is a Makefile in '/usr/lib/ssl/certs' directory, which can be used to generate PEM format CA.
So I run 'make cacert.pem' and it is created.
Lastly when I using curl with this CA:
$ curl --cacert ./cacert.pem -X GET https://bugzilla.redhat.com
Segmentation fault

So I'm not sure about how to use curl with nss support efficiently.
Thanks in advance!


Thanks,
Xufeng Zhang
张绪峰
2010-12-09 08:16:18 UTC
Permalink
At 2010-12-09 15:47:21£¬"ÕÅÐ÷·å" <***@126.com> wrote:
Hi All,

I have some problems with curl+nss usage.

Version
--------------
$ curl -V
curl 7.20.0 (i686-target-linux-gnu) libcurl/7.20.0 NSS/3.12.4.5 zlib/1.2.5 libidn/0.6.5
Protocols: dict file ftp ftps http https imap imaps pop3 pop3s rtsp smtp smtps telnet tftp
Features: IDN IPv6 Largefile SSL libz
---------------
NSS database is in '/etc/pki/nssdb' directory.
When I run certutil, the output is:
$ certutil -L -d /etc/pki/nssdb/
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
I don't know why there is no nickname output.
I also find there is a Makefile in '/usr/lib/ssl/certs' directory, which can be used to generate PEM format CA.
So I run 'make cacert.pem' and it is created.
Lastly when I using curl with this CA:
$ curl --cacert ./cacert.pem -X GET https://bugzilla.redhat.com

Maybe I have used the wrong command, run it as below:
$ curl --cert ./cacert.pem -X GET https://bugzilla.redhat.com
curl: (77) Problem with the SSL CA cert (path? access rights?)

Also fails, need help.

Thanks,
Xufeng Zhang



Segmentation fault

So I'm not sure about how to use curl with nss support efficiently.
Thanks in advance!


Thanks,
Xufeng Zhang





ÍøÒ×163/126ÓÊÏä°Ù·Ö°ÙŒæÈÝiphone ipadÓÊŒþÊÕ·¢
Kamil Dudka
2010-12-09 09:10:21 UTC
Permalink
Post by 张绪峰
Hi All,
I have some problems with curl+nss usage.
What exactly are you going to do?

What are the problems?
Post by 张绪峰
Version
--------------
$ curl -V
curl 7.20.0 (i686-target-linux-gnu) libcurl/7.20.0 NSS/3.12.4.5 zlib/1.2.5
libidn/0.6.5 Protocols: dict file ftp ftps http https imap imaps pop3 pop3s
rtsp smtp smtps telnet tftp Features: IDN IPv6 Largefile SSL libz
What distribution are you using? Are the packages provided by your distro?
Post by 张绪峰
NSS database is in '/etc/pki/nssdb' directory.
$ certutil -L -d /etc/pki/nssdb/
Certificate Nickname Trust
Attributes SSL,S/MIME,JAR/XPI I don't know why there is no nickname output.
If you have working Firefox, you can try to point curl to its database by
setting $SSL_DIR.
Post by 张绪峰
I also find there is a Makefile in '/usr/lib/ssl/certs' directory, which
can be used to generate PEM format CA. So I run 'make cacert.pem' and it is
created.
$ curl --cacert ./cacert.pem -X GET https://bugzilla.redhat.com
Segmentation fault
If you are able to repeat the crash with the latest curl/nss, please attach
the certificate that causes the crash. What does the following command say?

$ openssl x509 -in ./cacert.pem -noout -text

Kamil
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se
张绪峰
2010-12-09 10:04:40 UTC
Permalink
Hi Kamil,
Thanks for your reply.
Post by Kamil Dudka
Post by 张绪峰
Hi All,
I have some problems with curl+nss usage.
What exactly are you going to do?
I'm not sure about how to use curl with nss support.
Post by Kamil Dudka
What are the problems?
Can't access https:// through CA.
Post by Kamil Dudka
Post by 张绪峰
Version
--------------
$ curl -V
curl 7.20.0 (i686-target-linux-gnu) libcurl/7.20.0 NSS/3.12.4.5 zlib/1.2.5
libidn/0.6.5 Protocols: dict file ftp ftps http https imap imaps pop3 pop3s
rtsp smtp smtps telnet tftp Features: IDN IPv6 Largefile SSL libz
What distribution are you using? Are the packages provided by your distro?
$ uname -a
Linux localhost 2.6.34.7 #1 PREEMPT Mon Dec 6 19:39:02 CST 2010 i686 i686 i386 GNU/Linux

curl+nss is base on cross-compiling building.
Post by Kamil Dudka
Post by 张绪峰
NSS database is in '/etc/pki/nssdb' directory.
$ certutil -L -d /etc/pki/nssdb/
Certificate Nickname Trust
Attributes SSL,S/MIME,JAR/XPI I don't know why there is no nickname output.
If you have working Firefox, you can try to point curl to its database by
setting $SSL_DIR.
Firefox is not installed.
If I have set $SSL_DIR, then how to use it?
$ curl -E -X GET https://bugzilla.redhat.com ?
can't woks.
Post by Kamil Dudka
Post by 张绪峰
I also find there is a Makefile in '/usr/lib/ssl/certs' directory, which
can be used to generate PEM format CA. So I run 'make cacert.pem' and it is
created.
$ curl --cacert ./cacert.pem -X GET https://bugzilla.redhat.com
Segmentation fault
If you are able to repeat the crash with the latest curl/nss, please attach
the certificate that causes the crash. What does the following command say?
$ openssl x509 -in ./cacert.pem -noout -text
If use as below, then there is no crash:
$ curl --cert ./cacert.pem -X GET https://bugzilla.redhat.com
curl: (77) Problem with the SSL CA cert (path? access rights?)


$ openssl x509 -in ./cacert.pem -noout -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 0 (0x0)
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=CN, ST=BJ, L=BJ, O=WR, OU=SD
Validity
Not Before: Nov 9 12:19:05 1992 GMT
Not After : Nov 9 12:19:05 1993 GMT
Subject: C=CN, ST=BJ, L=BJ, O=WR, OU=SD
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:bc:18:8c:af:66:42:ec:9d:a8:27:40:03:98:0a:
fe:8a:30:f2:85:ae:1c:e4:72:ef:33:22:16:0d:12:
20:d9:a3:45:e5:df:ab:c9:8c:3a:54:86:67:ff:c1:
de:98:35:81:85:ba:a5:0c:c7:fd:15:b2:08:e4:07:
64:8d:da:3a:a3:03:0d:c5:12:ec:88:71:6b:8f:64:
17:97:70:13:6f:24:a8:d4:73:6c:85:9f:bb:c9:30:
ee:ff:4d:df:96:77:fa:8e:94:a6:b2:6d:59:d1:ce:
6e:1c:04:b0:e3:b2:76:3a:96:75:3c:6f:18:65:ba:
5a:5b:91:ff:68:ac:00:1c:fd:62:2e:bb:a8:8e:f8:
35:df:1a:58:55:da:8a:f3:8b:d9:db:36:a1:39:8a:
85:47:0d:3c:79:d6:38:ac:b2:e7:00:e1:8f:9f:ac:
67:39:e9:a1:79:7b:ae:c3:f6:5e:01:6f:c4:de:c6:
38:76:c4:cb:b8:41:59:ac:89:ac:1c:ea:68:9d:eb:
a4:da:45:0b:09:6e:70:fe:25:a2:92:f5:41:dd:40:
c2:04:a8:23:f5:88:20:40:27:2e:4b:d3:9b:4e:6c:
45:74:01:51:a0:4c:49:f9:e3:5e:c0:32:b7:45:96:
8f:ba:ca:1e:53:01:87:de:55:b7:28:13:53:14:94:
de:d7
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
39:28:9D:92:1C:30:F5:9A:EB:A7:D4:7C:30:C5:0E:5C:0F:19:49:C2
X509v3 Authority Key Identifier:
keyid:39:28:9D:92:1C:30:F5:9A:EB:A7:D4:7C:30:C5:0E:5C:0F:19:49:C2

X509v3 Basic Constraints:
CA:TRUE
Signature Algorithm: sha1WithRSAEncryption
04:d7:2a:c2:46:92:a6:64:5a:72:bb:7c:9d:47:77:7d:06:eb:
2b:e3:8a:b0:a6:6f:d4:4f:57:7e:fd:58:78:91:28:f5:b4:8f:
3e:1a:a7:45:57:96:64:ad:d8:b4:d5:cc:22:ac:ef:78:a2:35:
ef:48:f2:58:e5:1f:c7:24:14:0d:08:89:b9:d5:7c:cb:df:17:
15:37:0d:57:ed:d3:cf:2a:f4:df:4f:ec:31:97:dd:af:d3:56:
b4:84:8a:61:5f:3f:44:a6:8d:32:b0:41:c7:2f:9d:e2:09:d1:
26:73:6e:77:91:30:1c:9c:46:4f:42:ad:ef:cf:1d:89:46:15:
04:a6:7c:f3:7f:b8:94:12:4a:4a:a0:07:c6:7d:1a:c8:be:28:
f8:fa:ac:20:80:16:75:61:2b:bd:e0:5a:aa:a7:a6:dd:6a:ae:
34:d3:62:95:79:74:98:8b:2f:22:f2:e1:f2:d3:be:6e:0d:bc:
3e:c2:0b:ed:31:71:1a:16:9f:69:af:f9:79:35:e2:7c:6a:e3:
79:f5:4e:2f:8f:33:24:66:cb:f5:88:d1:e3:c3:56:16:08:b1:
b4:2f:c7:55:38:51:6b:6c:d1:37:16:da:5d:a3:70:e9:34:76:
1e:2d:94:87:49:5f:2f:ae:d8:3d:0b:28:3e:aa:72:1c:8d:1a:
39:48:9f:06


Thanks,
Xufeng Zhang
Post by Kamil Dudka
Kamil
Kamil Dudka
2010-12-09 10:46:11 UTC
Permalink
Post by 张绪峰
I'm not sure about how to use curl with nss support.
The natural way for NSS is to go through NSS database. You can specify its
path by the environment variable SSL_DIR. You need to load your certificates
into NSS database using certutil. Another way is to load PEM
certificates/keys directly by curl. It, however, requires you to have a PEM
reader PKCS11 module, which has not been accepted by NSS upstream yet:

https://bugzilla.mozilla.org/show_bug.cgi?id=402712
Post by 张绪峰
Post by Kamil Dudka
What are the problems?
Can't access https:// through CA.
Post by Kamil Dudka
Post by 张绪峰
Version
--------------
$ curl -V
curl 7.20.0 (i686-target-linux-gnu) libcurl/7.20.0 NSS/3.12.4.5
zlib/1.2.5 libidn/0.6.5 Protocols: dict file ftp ftps http https imap
imaps pop3 pop3s rtsp smtp smtps telnet tftp Features: IDN IPv6
Largefile SSL libz
What distribution are you using? Are the packages provided by your distro?
$ uname -a
Linux localhost 2.6.34.7 #1 PREEMPT Mon Dec 6 19:39:02 CST 2010 i686 i686 i386 GNU/Linux
It does not say much about the distribution. But it is likely not Fedora
nor RHEL, which means you probably don't have the PEM reader installed on
your system by default.
Post by 张绪峰
curl+nss is base on cross-compiling building.
Post by Kamil Dudka
Post by 张绪峰
NSS database is in '/etc/pki/nssdb' directory.
$ certutil -L -d /etc/pki/nssdb/
Certificate Nickname Trust
Attributes SSL,S/MIME,JAR/XPI I don't know why there is no nickname output.
If you have working Firefox, you can try to point curl to its database by
setting $SSL_DIR.
Firefox is not installed.
If I have set $SSL_DIR, then how to use it?
$ curl -E -X GET https://bugzilla.redhat.com ?
can't woks.
export SSL_DIR=/path/to/your/database
Post by 张绪峰
Post by Kamil Dudka
Post by 张绪峰
I also find there is a Makefile in '/usr/lib/ssl/certs' directory, which
can be used to generate PEM format CA. So I run 'make cacert.pem' and it
is created.
$ curl --cacert ./cacert.pem -X GET https://bugzilla.redhat.com
Segmentation fault
If you are able to repeat the crash with the latest curl/nss, please
attach the certificate that causes the crash. What does the following
command say?
$ openssl x509 -in ./cacert.pem -noout -text
$ curl --cert ./cacert.pem -X GET https://bugzilla.redhat.com
curl: (77) Problem with the SSL CA cert (path? access rights?)
You can't supply CA as client certificate. I'll try to reproduce the crash
myself. Please give me some steps to reproduce.

Kamil
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
张绪峰
2010-12-10 01:46:08 UTC
Permalink
Hi Kamil,

Thanks very much for your help.
Post by Kamil Dudka
Post by 张绪峰
I'm not sure about how to use curl with nss support.
The natural way for NSS is to go through NSS database. You can specify its
path by the environment variable SSL_DIR. You need to load your certificates
into NSS database using certutil. Another way is to load PEM
certificates/keys directly by curl. It, however, requires you to have a PEM
https://bugzilla.mozilla.org/show_bug.cgi?id=402712
Post by 张绪峰
Post by Kamil Dudka
What are the problems?
Can't access https:// through CA.
Post by Kamil Dudka
Post by 张绪峰
Version
--------------
$ curl -V
curl 7.20.0 (i686-target-linux-gnu) libcurl/7.20.0 NSS/3.12.4.5
zlib/1.2.5 libidn/0.6.5 Protocols: dict file ftp ftps http https imap
imaps pop3 pop3s rtsp smtp smtps telnet tftp Features: IDN IPv6
Largefile SSL libz
What distribution are you using? Are the packages provided by your distro?
$ uname -a
Linux localhost 2.6.34.7 #1 PREEMPT Mon Dec 6 19:39:02 CST 2010 i686
i686 i386 GNU/Linux
It does not say much about the distribution. But it is likely not Fedora
nor RHEL, which means you probably don't have the PEM reader installed on
your system by default.
Yeah, there is no PEM reader in my system, I can find there is a pk12util.
Post by Kamil Dudka
Post by 张绪峰
curl+nss is base on cross-compiling building.
Post by Kamil Dudka
Post by 张绪峰
NSS database is in '/etc/pki/nssdb' directory.
$ certutil -L -d /etc/pki/nssdb/
Certificate Nickname Trust
Attributes SSL,S/MIME,JAR/XPI I don't know why there is no nickname output.
If you have working Firefox, you can try to point curl to its database by
setting $SSL_DIR.
Firefox is not installed.
If I have set $SSL_DIR, then how to use it?
$ curl -E -X GET https://bugzilla.redhat.com ?
can't woks.
export SSL_DIR=/path/to/your/database
But what about after? I also can't find my certificates.
1. $ certutil -L -d /etc/pki/nssdb
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
2. $ export SSL_DIR=/etc/pki/nssdb
3. ??
Post by Kamil Dudka
Post by 张绪峰
Post by Kamil Dudka
Post by 张绪峰
I also find there is a Makefile in '/usr/lib/ssl/certs' directory, which
can be used to generate PEM format CA. So I run 'make cacert.pem' and it
is created.
$ curl --cacert ./cacert.pem -X GET https://bugzilla.redhat.com
Segmentation fault
If you are able to repeat the crash with the latest curl/nss, please
attach the certificate that causes the crash. What does the following
command say?
$ openssl x509 -in ./cacert.pem -noout -text
$ curl --cert ./cacert.pem -X GET https://bugzilla.redhat.com
curl: (77) Problem with the SSL CA cert (path? access rights?)
You can't supply CA as client certificate. I'll try to reproduce the crash
myself. Please give me some steps to reproduce.
cacert.pem and Makefile have been attached, I have renamed Makefile to Makefile.txt.
Sorry, I also can't reproduce the crash now, werid, this time when I run:
$ curl --cacert ./cacert.pem https://bugzilla.redhat.com
curl: (60) Peer certificate cannot be authenticated with known CA certificates
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.


Thanks,
Xufeng Zhang
Post by Kamil Dudka
Kamil
Kamil Dudka
2010-12-11 22:36:57 UTC
Permalink
Post by 张绪峰
Post by Kamil Dudka
Post by 张绪峰
Post by Kamil Dudka
What distribution are you using? Are the packages provided by your distro?
$ uname -a
Linux localhost 2.6.34.7 #1 PREEMPT Mon Dec 6 19:39:02 CST 2010 i686
i686 i386 GNU/Linux
It does not say much about the distribution. But it is likely not Fedora
nor RHEL, which means you probably don't have the PEM reader installed on
your system by default.
Yeah, there is no PEM reader in my system, I can find there is a pk12util.
You still didn't answer what your distribution is.
Post by 张绪峰
Post by Kamil Dudka
export SSL_DIR=/path/to/your/database
But what about after? I also can't find my certificates.
1. $ certutil -L -d /etc/pki/nssdb
Certificate Nickname Trust
Attributes SSL,S/MIME,JAR/XPI 2. $ export SSL_DIR=/etc/pki/nssdb
SSL_DIR only specifies which NSS database curl uses. It does not change
anything in there. curl opens the database read-only. You need to modify
the database yourself, independently on curl:

http://www.mozilla.org/projects/security/pki/nss/tools/certutil.html
Post by 张绪峰
cacert.pem and Makefile have been attached, I have renamed Makefile to
Makefile.txt. Sorry, I also can't reproduce the crash now, werid, this time
when I run: $ curl --cacert ./cacert.pem https://bugzilla.redhat.com
curl: (60) Peer certificate cannot be authenticated with known CA
certificates More details here: http://curl.haxx.se/docs/sslcerts.html
How are you going to verify authenticity of bugzilla.redhat.com with your
self-signed certificate? You need to load root CA certificates instead.

Kamil
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette
张绪峰
2010-12-10 01:55:48 UTC
Permalink
Post by Kamil Dudka
Post by 张绪峰
I'm not sure about how to use curl with nss support.
The natural way for NSS is to go through NSS database. You can specify its
path by the environment variable SSL_DIR. You need to load your certificates
into NSS database using certutil. Another way is to load PEM
certificates/keys directly by curl. It, however, requires you to have a PEM
https://bugzilla.mozilla.org/show_bug.cgi?id=402712
Post by 张绪峰
Post by Kamil Dudka
What are the problems?
Can't access https:// through CA.
Post by Kamil Dudka
Post by 张绪峰
Version
--------------
$ curl -V
curl 7.20.0 (i686-target-linux-gnu) libcurl/7.20.0 NSS/3.12.4.5
zlib/1.2.5 libidn/0.6.5 Protocols: dict file ftp ftps http https imap
imaps pop3 pop3s rtsp smtp smtps telnet tftp Features: IDN IPv6
Largefile SSL libz
What distribution are you using? Are the packages provided by your distro?
$ uname -a
Linux localhost 2.6.34.7 #1 PREEMPT Mon Dec 6 19:39:02 CST 2010 i686
i686 i386 GNU/Linux
It does not say much about the distribution. But it is likely not Fedora
nor RHEL, which means you probably don't have the PEM reader installed on
your system by default.
Post by 张绪峰
curl+nss is base on cross-compiling building.
Post by Kamil Dudka
Post by 张绪峰
NSS database is in '/etc/pki/nssdb' directory.
$ certutil -L -d /etc/pki/nssdb/
Certificate Nickname Trust
Attributes SSL,S/MIME,JAR/XPI I don't know why there is no nickname output.
If you have working Firefox, you can try to point curl to its database by
setting $SSL_DIR.
Firefox is not installed.
If I have set $SSL_DIR, then how to use it?
$ curl -E -X GET https://bugzilla.redhat.com ?
can't woks.
export SSL_DIR=/path/to/your/database
Post by 张绪峰
Post by Kamil Dudka
Post by 张绪峰
I also find there is a Makefile in '/usr/lib/ssl/certs' directory, which
can be used to generate PEM format CA. So I run 'make cacert.pem' and it
is created.
$ curl --cacert ./cacert.pem -X GET https://bugzilla.redhat.com
Segmentation fault
If you are able to repeat the crash with the latest curl/nss, please
attach the certificate that causes the crash. What does the following
command say?
$ openssl x509 -in ./cacert.pem -noout -text
$ curl --cert ./cacert.pem -X GET https://bugzilla.redhat.com
curl: (77) Problem with the SSL CA cert (path? access rights?)
You can't supply CA as client certificate. I'll try to reproduce the crash
myself. Please give me some steps to reproduce.
Oh, I know why I can't reproduce the crash now, I have changed PEM file
from "-----BEGIN PRIVATE KEY-----" to "-----BEGIN RSA PRIVATE KEY-----".
Use this cacert.pem file, you can reproduce the crash by running:
$ curl --cacert /the/path/to/cacert.pem https://bugzilla.redhat.com
Segmentation fault

Thanks,
Xufeng Zhang
Post by Kamil Dudka
Kamil
Kamil Dudka
2010-12-11 22:38:12 UTC
Permalink
Post by 张绪峰
Oh, I know why I can't reproduce the crash now, I have changed PEM file
from "-----BEGIN PRIVATE KEY-----" to "-----BEGIN RSA PRIVATE KEY-----".
$ curl --cacert /the/path/to/cacert.pem https://bugzilla.redhat.com
Segmentation fault
I am still not able to repeat the crash. Please provide a backtrace.

Kamil
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Et
张绪峰
2010-12-10 05:40:09 UTC
Permalink
Hi Kamil,

I think the root cause of my problem maybe there is not a valid certificate in my system,
I find there is an configure option "--with-ca-bundle=%{_sysconfdir}/pki/tls/certs/ca-bundle.crt"
in curl.spec, but I can't find ca-bundle.crt file in my system.

Thanks,
Xufeng Zhang
Post by Kamil Dudka
Post by 张绪峰
I'm not sure about how to use curl with nss support.
The natural way for NSS is to go through NSS database. You can specify its
path by the environment variable SSL_DIR. You need to load your certificates
into NSS database using certutil. Another way is to load PEM
certificates/keys directly by curl. It, however, requires you to have a PEM
https://bugzilla.mozilla.org/show_bug.cgi?id=402712
Post by 张绪峰
Post by Kamil Dudka
What are the problems?
Can't access https:// through CA.
Post by Kamil Dudka
Post by 张绪峰
Version
--------------
$ curl -V
curl 7.20.0 (i686-target-linux-gnu) libcurl/7.20.0 NSS/3.12.4.5
zlib/1.2.5 libidn/0.6.5 Protocols: dict file ftp ftps http https imap
imaps pop3 pop3s rtsp smtp smtps telnet tftp Features: IDN IPv6
Largefile SSL libz
What distribution are you using? Are the packages provided by your distro?
$ uname -a
Linux localhost 2.6.34.7 #1 PREEMPT Mon Dec 6 19:39:02 CST 2010 i686
i686 i386 GNU/Linux
It does not say much about the distribution. But it is likely not Fedora
nor RHEL, which means you probably don't have the PEM reader installed on
your system by default.
Post by 张绪峰
curl+nss is base on cross-compiling building.
Post by Kamil Dudka
Post by 张绪峰
NSS database is in '/etc/pki/nssdb' directory.
$ certutil -L -d /etc/pki/nssdb/
Certificate Nickname Trust
Attributes SSL,S/MIME,JAR/XPI I don't know why there is no nickname output.
If you have working Firefox, you can try to point curl to its database by
setting $SSL_DIR.
Firefox is not installed.
If I have set $SSL_DIR, then how to use it?
$ curl -E -X GET https://bugzilla.redhat.com ?
can't woks.
export SSL_DIR=/path/to/your/database
Post by 张绪峰
Post by Kamil Dudka
Post by 张绪峰
I also find there is a Makefile in '/usr/lib/ssl/certs' directory, which
can be used to generate PEM format CA. So I run 'make cacert.pem' and it
is created.
$ curl --cacert ./cacert.pem -X GET https://bugzilla.redhat.com
Segmentation fault
If you are able to repeat the crash with the latest curl/nss, please
attach the certificate that causes the crash. What does the following
command say?
$ openssl x509 -in ./cacert.pem -noout -text
$ curl --cert ./cacert.pem -X GET https://bugzilla.redhat.com
curl: (77) Problem with the SSL CA cert (path? access rights?)
You can't supply CA as client certificate. I'll try to reproduce the crash
myself. Please give me some steps to reproduce.
Kamil
Daniel Stenberg
2010-12-10 07:13:13 UTC
Permalink
Post by 张绪峰
I think the root cause of my problem maybe there is not a valid certificate
in my system, I find there is an configure option
"--with-ca-bundle=%{_sysconfdir}/pki/tls/certs/ca-bundle.crt" in curl.spec,
but I can't find ca-bundle.crt file in my system.
You can get the one Firefox uses from here:

http://curl.haxx.se/docs/caextract.html

(and please don't top-post)
--
/ daniel.haxx.se
张绪峰
2010-12-10 07:20:36 UTC
Permalink
Post by 张绪峰
Post by 张绪峰
I think the root cause of my problem maybe there is not a valid certificate
in my system, I find there is an configure option
"--with-ca-bundle=%{_sysconfdir}/pki/tls/certs/ca-bundle.crt" in curl.spec,
but I can't find ca-bundle.crt file in my system.
http://curl.haxx.se/docs/caextract.html
Thanks for your help, I have just tried, still doesn't work.
when I run "curl --cacert cacert.pem https://bugzilla.mozilla.org", it got following output:
curl: (60) Peer certificate cannot be authenticated with known CA certificates
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.


Thanks,
Xufeng Zhang
Post by 张绪峰
(and please don't top-post)
--
/ daniel.haxx.se
Daniel Stenberg
2010-12-10 08:07:46 UTC
Permalink
Post by 张绪峰
http://curl.haxx.se/docs/caextract.html
Thanks for your help, I have just tried, still doesn't work. when I run
"curl --cacert cacert.pem https://bugzilla.mozilla.org", it got following
output: curl: (60) Peer certificate cannot be authenticated with known CA
certificates More details here: http://curl.haxx.se/docs/sslcerts.html
... as Kamil explained previously, NSS does not (yet) support loading PEM
files like that but needs a patch for it (that Fedora has applied on the NSS
they ship).

So I believe the solutions to have to select from are that you either don't
use PEM certificates with NSS, or you arrange your NSS library to have PEM
support.
--
/ daniel.haxx.se
张绪峰
2010-12-10 08:15:20 UTC
Permalink
Post by Daniel Stenberg
Post by 张绪峰
http://curl.haxx.se/docs/caextract.html
Thanks for your help, I have just tried, still doesn't work. when I run
"curl --cacert cacert.pem https://bugzilla.mozilla.org", it got following
output: curl: (60) Peer certificate cannot be authenticated with known CA
certificates More details here: http://curl.haxx.se/docs/sslcerts.html
... as Kamil explained previously, NSS does not (yet) support loading PEM
files like that but needs a patch for it (that Fedora has applied on the NSS
they ship).
Some detail info:
$ curl --cacert cacert.pem -v https://www.mozilla.org
* About to connect() to www.mozilla.org port 443 (#0)
* Trying 63.245.217.21... connected
* Connected to www.mozilla.org (63.245.217.21) port 443 (#0)
* Initializing NSS with certpath: /etc/pki/nssdb
* CAfile: cacert.pem
CApath: none
* Remote Certificate has expired.
* NSS error -8181
* Closing connection #0
* Peer certificate cannot be authenticated with known CA certificates
curl: (60) Peer certificate cannot be authenticated with known CA certificates
Post by Daniel Stenberg
So I believe the solutions to have to select from are that you either don't
use PEM certificates with NSS, or you arrange your NSS library to have PEM
support.
Both are OK, then which one is an easy way? and how to do it?
Thanks very much!


Thanks,
Xufeng Zhang
Post by Daniel Stenberg
--
/ daniel.haxx.se
张绪峰
2010-12-10 08:33:05 UTC
Permalink
Post by Daniel Stenberg
Post by 张绪峰
http://curl.haxx.se/docs/caextract.html
Thanks for your help, I have just tried, still doesn't work. when I run
"curl --cacert cacert.pem https://bugzilla.mozilla.org", it got following
output: curl: (60) Peer certificate cannot be authenticated with known CA
certificates More details here: http://curl.haxx.se/docs/sslcerts.html
... as Kamil explained previously, NSS does not (yet) support loading PEM
files like that but needs a patch for it (that Fedora has applied on the NSS
they ship).
So I believe the solutions to have to select from are that you either don't
use PEM certificates with NSS, or you arrange your NSS library to have PEM
support.
I find there is libnsspem.so library in my system, so why NSS can't support PEM format?

Thanks,
Xufeng Zhang
Post by Daniel Stenberg
--
/ daniel.haxx.se
Kamil Dudka
2010-12-11 22:44:42 UTC
Permalink
Post by 张绪峰
Post by Daniel Stenberg
So I believe the solutions to have to select from are that you either
don't use PEM certificates with NSS, or you arrange your NSS library to
have PEM support.
I find there is libnsspem.so library in my system, so why NSS can't support PEM format?
That would explain the crash ;-) Please make sure you have its most recent
version. There used to be tons of crucial bugs in the initial version.
The PEM module is still a work in progress from what I know.

Kamil
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://cu
xufeng zhang
2010-12-14 03:15:34 UTC
Permalink
Post by Kamil Dudka
Post by 张绪峰
Post by Daniel Stenberg
So I believe the solutions to have to select from are that you either
don't use PEM certificates with NSS, or you arrange your NSS library to
have PEM support.
I find there is libnsspem.so library in my system, so why NSS can't support PEM format?
That would explain the crash ;-) Please make sure you have its most recent
version. There used to be tons of crucial bugs in the initial version.
The PEM module is still a work in progress from what I know.
Kamil
Hi Kamil,

I'm using nss-3.12.4, the newest NSS release, and the system I'm using
is not
a standard distribution.
This problem really disturb me.

I got a cacert.pem file from http://curl.haxx.se/docs/caextract.html,
still can't work:
$ curl --cacert cacert.pem -v https://bugzilla.mozilla.org
* About to connect() to bugzilla.mozilla.org port 443 (#0)
* Trying 63.245.209.72... connected
* Connected to bugzilla.mozilla.org (63.245.209.72) port 443 (#0)
* Initializing NSS with certpath: /etc/pki/nssdb
* CAfile: cacert.pem
CApath: none
* Remote Certificate has expired.
* NSS error -8181
* Closing connection #0
* Peer certificate cannot be authenticated with known CA certificates
curl: (60) Peer certificate cannot be authenticated with known CA
certificates
More details here: http://curl.haxx.se/docs/sslcerts.html
............................


I just want to write a test case to verify curl+nss works after I
enabled nss to curl,
why it's so difficult? :-(


Thanks,
Xufeng Zhang
Post by Kamil Dudka
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette.html
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-libr
Kamil Dudka
2010-12-14 08:19:47 UTC
Permalink
Post by xufeng zhang
I got a cacert.pem file from http://curl.haxx.se/docs/caextract.html,
$ curl --cacert cacert.pem -v https://bugzilla.mozilla.org
* About to connect() to bugzilla.mozilla.org port 443 (#0)
* Trying 63.245.209.72... connected
* Connected to bugzilla.mozilla.org (63.245.209.72) port 443 (#0)
* Initializing NSS with certpath: /etc/pki/nssdb
* CAfile: cacert.pem
CApath: none
* Remote Certificate has expired.
* NSS error -8181
8181 is SEC_ERROR_EXPIRED_CERTIFICATE Peer's certificate has expired.

Are your system date and time zone set properly?

Kamil
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette.html
xufeng zhang
2010-12-14 08:32:53 UTC
Permalink
Post by Kamil Dudka
Post by xufeng zhang
I got a cacert.pem file from http://curl.haxx.se/docs/caextract.html,
$ curl --cacert cacert.pem -v https://bugzilla.mozilla.org
* About to connect() to bugzilla.mozilla.org port 443 (#0)
* Trying 63.245.209.72... connected
* Connected to bugzilla.mozilla.org (63.245.209.72) port 443 (#0)
* Initializing NSS with certpath: /etc/pki/nssdb
* CAfile: cacert.pem
CApath: none
* Remote Certificate has expired.
* NSS error -8181
8181 is SEC_ERROR_EXPIRED_CERTIFICATE Peer's certificate has expired.
Are your system date and time zone set properly?
Oh, got it! it works! I forgot to set the system time in this embedded
system.
Thanks very very much, Kamil.


Thanks,
Xufeng Zhang
Post by Kamil Dudka
Kamil
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette.html
Daniel Stenberg
2010-12-14 08:27:44 UTC
Permalink
I'm using nss-3.12.4, the newest NSS release, and the system I'm using is
not a standard distribution. This problem really disturb me.
...
why it's so difficult? :-(
Because NSS has a different approach to certificates and files than what
libcurl was made for.

Because NSS upstream hasn't accepted the PEM reading patch.

Because not enough people in our project have streamlined the documentation
and polished everything.

Because NSS also lacks documentation for people that comes to this problem
from our angle.

Because software engineering is still engineering.

Because we are always undermanned and libcurl is to a large extent voluntary
driven and developed by people using up their spare time.

... I believe you get it now ;-)
--
/ daniel.haxx.se
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette.html
xufeng zhang
2010-12-14 08:47:25 UTC
Permalink
Post by Daniel Stenberg
Post by xufeng zhang
I'm using nss-3.12.4, the newest NSS release, and the system I'm
using is not a standard distribution. This problem really disturb me.
...
Post by xufeng zhang
why it's so difficult? :-(
Because NSS has a different approach to certificates and files than
what libcurl was made for.
Because NSS upstream hasn't accepted the PEM reading patch.
Because not enough people in our project have streamlined the
documentation and polished everything.
Because NSS also lacks documentation for people that comes to this
problem from our angle.
Because software engineering is still engineering.
Because we are always undermanned and libcurl is to a large extent
voluntary driven and developed by people using up their spare time.
... I believe you get it now ;-)
Thank you, Daniel.
Thanks to Kamil's remind, this problem has just resolved, my mistake.
I'm working for making curl+nss works in different embedded platforms,
now x86 works, a big leap.

Thanks,
Xufeng Zhang
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette.html

Philip Prindeville
2010-12-10 20:47:18 UTC
Permalink
Our spam filters keep getting false positives from email to an english-language mailing list being sent in esoteric Han character encodings like Giao Bao.

Can you please post in UTF8 or ISO-8859-1?

Thanks.
Post by 张绪峰
Hi Kamil,
I think the root cause of my problem maybe there is not a valid certificate in my system,
I find there is an configure option "--with-ca-bundle=%{_sysconfdir}/pki/tls/certs/ca-bundle.crt"
in curl.spec, but I can't find ca-bundle.crt file in my system.
Thanks,
Xufeng Zhang
Post by Kamil Dudka
Post by 张绪峰
I'm not sure about how to use curl with nss support.
The natural way for NSS is to go through NSS database. You can specify its
path by the environment variable SSL_DIR. You need to load your certificates
into NSS database using certutil. Another way is to load PEM
certificates/keys directly by curl. It, however, requires you to have a PEM
https://bugzilla.mozilla.org/show_bug.cgi?id=402712
Post by 张绪峰
Post by Kamil Dudka
What are the problems?
Can't access https:// through CA.
Post by Kamil Dudka
Post by 张绪峰
Version
--------------
$ curl -V
curl 7.20.0 (i686-target-linux-gnu) libcurl/7.20.0 NSS/3.12.4.5
zlib/1.2.5 libidn/0.6.5 Protocols: dict file ftp ftps http https imap
imaps pop3 pop3s rtsp smtp smtps telnet tftp Features: IDN IPv6
Largefile SSL libz
What distribution are you using? Are the packages provided by your distro?
$ uname -a
Linux localhost 2.6.34.7 #1 PREEMPT Mon Dec 6 19:39:02 CST 2010 i686
i686 i386 GNU/Linux
It does not say much about the distribution. But it is likely not Fedora
nor RHEL, which means you probably don't have the PEM reader installed on
your system by default.
Post by 张绪峰
curl+nss is base on cross-compiling building.
Post by Kamil Dudka
Post by 张绪峰
NSS database is in '/etc/pki/nssdb' directory.
$ certutil -L -d /etc/pki/nssdb/
Certificate Nickname Trust
Attributes SSL,S/MIME,JAR/XPI I don't know why there is no nickname output.
If you have working Firefox, you can try to point curl to its database by
setting $SSL_DIR.
Firefox is not installed.
If I have set $SSL_DIR, then how to use it?
$ curl -E -X GET https://bugzilla.redhat.com ?
can't woks.
export SSL_DIR=/path/to/your/database
Post by 张绪峰
Post by Kamil Dudka
Post by 张绪峰
I also find there is a Makefile in '/usr/lib/ssl/certs' directory, which
can be used to generate PEM format CA. So I run 'make cacert.pem' and it
is created.
$ curl --cacert ./cacert.pem -X GET https://bugzilla.redhat.com
Segmentation fault
If you are able to repeat the crash with the latest curl/nss, please
attach the certificate that causes the crash. What does the following
command say?
$ openssl x509 -in ./cacert.pem -noout -text
$ curl --cert ./cacert.pem -X GET https://bugzilla.redhat.com
curl: (77) Problem with the SSL CA cert (path? access rights?)
You can't supply CA as client certificate. I'll try to reproduce the crash
myself. Please give me some steps to reproduce.
Kamil
张绪峰
2010-12-10 07:10:31 UTC
Permalink
Hi Kamil,

I download cacert.pem file from http://curl.haxx.se/docs/caextract.html,
then I run:
$ curl --cacert cacert.pem https://bugzilla.mozilla.org

curl: (60) Peer certificate cannot be authenticated with known CA certificates
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.


I got the same output just as the PEM file I generated.
So what's the problem?


Thanks,
Xufeng Zhang
Post by Kamil Dudka
Post by 张绪峰
I'm not sure about how to use curl with nss support.
The natural way for NSS is to go through NSS database. You can specify its
path by the environment variable SSL_DIR. You need to load your certificates
into NSS database using certutil. Another way is to load PEM
certificates/keys directly by curl. It, however, requires you to have a PEM
https://bugzilla.mozilla.org/show_bug.cgi?id=402712
Post by 张绪峰
Post by Kamil Dudka
What are the problems?
Can't access https:// through CA.
Post by Kamil Dudka
Post by 张绪峰
Version
--------------
$ curl -V
curl 7.20.0 (i686-target-linux-gnu) libcurl/7.20.0 NSS/3.12.4.5
zlib/1.2.5 libidn/0.6.5 Protocols: dict file ftp ftps http https imap
imaps pop3 pop3s rtsp smtp smtps telnet tftp Features: IDN IPv6
Largefile SSL libz
What distribution are you using? Are the packages provided by your distro?
$ uname -a
Linux localhost 2.6.34.7 #1 PREEMPT Mon Dec 6 19:39:02 CST 2010 i686
i686 i386 GNU/Linux
It does not say much about the distribution. But it is likely not Fedora
nor RHEL, which means you probably don't have the PEM reader installed on
your system by default.
Post by 张绪峰
curl+nss is base on cross-compiling building.
Post by Kamil Dudka
Post by 张绪峰
NSS database is in '/etc/pki/nssdb' directory.
$ certutil -L -d /etc/pki/nssdb/
Certificate Nickname Trust
Attributes SSL,S/MIME,JAR/XPI I don't know why there is no nickname output.
If you have working Firefox, you can try to point curl to its database by
setting $SSL_DIR.
Firefox is not installed.
If I have set $SSL_DIR, then how to use it?
$ curl -E -X GET https://bugzilla.redhat.com ?
can't woks.
export SSL_DIR=/path/to/your/database
Post by 张绪峰
Post by Kamil Dudka
Post by 张绪峰
I also find there is a Makefile in '/usr/lib/ssl/certs' directory, which
can be used to generate PEM format CA. So I run 'make cacert.pem' and it
is created.
$ curl --cacert ./cacert.pem -X GET https://bugzilla.redhat.com
Segmentation fault
If you are able to repeat the crash with the latest curl/nss, please
attach the certificate that causes the crash. What does the following
command say?
$ openssl x509 -in ./cacert.pem -noout -text
$ curl --cert ./cacert.pem -X GET https://bugzilla.redhat.com
curl: (77) Problem with the SSL CA cert (path? access rights?)
You can't supply CA as client certificate. I'll try to reproduce the crash
myself. Please give me some steps to reproduce.
Kamil
Loading...