curl: (60) SSL certificate problem: unable to get local issuer certificate

Question

root@sclrdev:/home/sclr/certs/FreshCerts# curl --ftp-ssl --verbose ftp://{abc}/ -u trup:trup --cacert /etc/ssl/certs/ca-certificates.crt
* About to connect() to {abc         


        

Answer 1

This is ssh certificate store issue. You need to download the valid certificate pem file from target CA website, and then build the soft link file to instruct ssl the trusted certifacate.

openssl x509 -hash -noout -in DigiCert_Global_Root_G3.pem

you will get dd8e9d41

build solf link with hash number and suffix the file with a .0 (dot-zero)

dd8e9d41.0

Then try again.

Answer 2

On windows I was having this problem. Curl was installed by mysysgit, so downloading and installing the newest version fixed my issue.

Otherwise these are decent instructions on how to update your CA cert that you could try.

Answer 3

It might be sufficient to just update the list of certificates

sudo update-ca-certificates -f

update-ca-certificates is a program that updates the directory /etc/ssl/certs to hold SSL certificates and generates ca-certificates.crt, a concatenated single-file list of certificates.

Answer 4

Simple solution: IN ~/.sdkman/etc/config, change sdkman_insecure_ssl=true

Steps:
nano ~/.sdkman/etc/config
change sdkman_insecure_ssl=false to sdkman_insecure_ssl=true
save and exit

Answer 5

Try reinstalling curl in Ubuntu, and updating my CA certs with sudo update-ca-certificates --fresh which updated the certs

Answer 6

Had that problem and it was not solved with newer version. /etc/certs had the root cert, the browser said everything is fine. After some testing I got from ssllabs.com the warning, that my chain was not complete (Indeed it was the chain for the old certificate and not the new one). After correcting the cert chain everything was fine, even with curl.