Fresh install of Mediawiki 1.37.2 on Ubuntu gives an error with the visual editor:
Error contacting the Parsoid/RESTBase server: (curl error: 77) Problem with the SSL CA cert (path? access rights?)
in LocalSettings.php is only put:
wfLoadExtension( 'VisualEditor' );
How could this be solved?
Can well be a permission issue. Make sure that your certificate is readable by both root and web server user (probably, www-data). Can be done by chown root:www-data fullchain.pem privkey.pem; chmod g+r fullchain.pem privkey.pem.
I found the answer to the problem:
This page helped out: https://github.com/curl/curl/issues/3793
It is caused by a wrong certificate being used on curl. To fix the problem the following was executed:
Download the cacert.pem file from the Curl's site: https://curl.haxx.se/docs/caextract.html;
Place certificate inside the domain's root directory.
Specify the path to it in php.ini.
curl.cainfo = /var/www/vhosts/example.com/httpdocs/cacert.pem
When I run something like:
git clone https://gitlab.mydoman.com/test.git
from part of the clients, I get the error:
Peer's Certificate issuer is not recognized
I saw 2 main solution:
1. User can set
export GIT_SSL_NO_VERIFY=true
2. to install root certificates
I would like to solve the problem to all the users.
I did not understood how to install the root certificate and where I configure Gitlab to use it. Is there url to clear instruction?
Thanks.
As part of an automated build, we run download some code from github. Minimal example:
wget github.com
Recently, the command started failing with a certificate error:
URL transformed to HTTPS due to an HSTS policy
--2017-10-05 11:43:45-- https://github.com/
Resolving github.com (github.com)... 192.30.253.112, 192.30.253.113
Connecting to github.com (github.com)|192.30.253.112|:443... connected.
ERROR: cannot verify github.com's certificate, issued by 'CN=DigiCert SHA2 Extended Validation Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US':
Unable to locally verify the issuer's authority.
I tried updating the certificate store, and wget itself:
update-ca-certificates
apt-get install wget
The error is still the same.
My wget version is GNU Wget 1.17.1, and the OS is Ubuntu 16.04.3.
You can avoid checking the validity of the certificate adding the --no-check-certificate option on the wget command-line.
The answer turned out to lie somewhere in packet configuration. Unfortunately, I am unable to tell exactly why. The suspicion is some mono version installed from a ppa was messing with our cert store.
I am getting the below error while making ssl connection with self signed certificate.
"Peer certificate cannot be authenticated with known CA certificates"
It is working fine with CA signed certificate.
I am setting the below using curl_easy_setopt().
curl_easy_setopt(MyContext, CURLOPT_CAPATH, CA_CERTIFICATE_PATH)
curl_easy_setopt(MyContext, CURLOPT_SSL_VERIFYPEER,TRUE);
The curl version:
libcurl-7.19.7-26
Openssl version is:
0_9_8u
Please let me know how to solve this issue.
By default CURL will generally verify the SSL certificate to see if its valid and issued by an accepted CA. To do this, curl uses a bundled set of CA certificates.
If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option. Here's an example:
curl --noproxy -k \* -D - https://127.0.0.1:443/some-secure-endpoint
Security issue: This answer disables a security feature. Do not use this in production!
For php it is possible to switch off curl's verification of the certificate (see warning below) e.g. for curl_exec
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
http://php.net/manual/en/function.curl-setopt.php
(evaluate the security risk yourself, in my case it was on a partner company's server and the file required contained no secure information - just happened to be on a secure server)
We fixed a similar issue on CentOS 6 by updating curl to the latest version available in the standard repositories and installing the newest ca-certificates bundle:
yum update curl
yum install ca-certificates
libcurl performs peer SSL certificate verification by default. This is done
by using CA cert bundle that the SSL library can use to make sure the peer's
server certificate is valid.
If you communicate with HTTPS or FTPS servers using certificates that are
signed by CAs present in the bundle, you can be sure that the remote server
really is the one it claims to be.
Until 7.18.0, curl bundled a severely outdated ca bundle file that was
installed by default. These days, the curl archives include no ca certs at
all. You need to get them elsewhere. See below for example.
For more to know about Peer SSL Certificate Verification visit http://curl.haxx.se/docs/sslcerts.html
Though this error happened in the case of using git clone rather than with using curl, I've recently stumbled across an identical error message:
Peer certificate cannot be authenticated with known CA certificates
Similar to Arth's findings, something that worked for CentOS 6 (in order to successfully use HTTPS URLs with git clone for related GitLab repositories) involved updating the trusted certificates on the server (i.e., the server that is using HTTPS), using the following steps:
sudo yum install ca-certificates
sudo update-ca-trust enable
sudo cp /path/to/your_new_cert.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust extract
Perhaps the same certificate steps can be applied for the case of curl (or other similar scenarios) for users on CentOS in the future.
Security issue: This answer disables a security feature. Do not use this in production!
In 'C'
curl_easy_setopt(curl_handle, CURLOPT_SSL_VERIFYPEER, 0);
worked for me
As we checked and observed/ Found in Centos 8 .
Due to Proxy issue your packages not allowing you to get accessible to update or download any packages.
try to add sslverify=0 in file /etc/dnf/dnf.conf
Its worked for me.
Also make sure you must have proper internet acess on your server.
I'm running Ubuntu 11.10 and I'm trying to install RVM.
I enter "bash < <(curl -s https://raw.github.com/wayneeseguin/rvm/master/binscripts/rvm-installer)" and then press enter, and nothing happens. It pauses for a second and then returns to the command prompt.
RVM doesn't install. I run rmv-v and get The program 'rvm' is currently not installed.
No errors.
Any thoughts?
Thanks.
Jason
UPDATE: I removed the -s option from curl and now I see some messages. Specifically:
0curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
UPDATE 2: I reinstalled Git, and now when I run curl-config --ca, I get:
curl-config --ca
/etc/ssl/certs/ca-certificates.crt
I downloaded the cacert.pem file from curl.haxx.se and created a new ca-certificates.crt file with it.
However, I'm still getting:
0curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Not sure what else to try other than disabling the checking, which I'd rather not do.
The SSL certificate on https://rvm.io expired. Looks like RVM migrated to a new domain. See: https://github.com/wayneeseguin/rvm/issues/889