| Summary: | curl --capath does not work | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | JJ Keijser <jan.just.keijser> |
| Component: | curl | Assignee: | Kamil Dudka <kdudka> |
| Status: | CLOSED NEXTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | low | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 13 | CC: | kdudka, paul |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-09-12 11:32:29 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
JJ Keijser
2011-08-26 21:23:33 UTC
posted wrong "expected result"; here is the correct output:
* About to connect() to grasveld.nikhef.nl port 9000
* Trying 194.171.97.21... connected
* Connected to grasveld.nikhef.nl (194.171.97.21) port 9000
* successfully set certificate verify locations:
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: /global/ices/lcg/glite3.2.8/etc/grid-security/certificates
* SSLv3, TLS handshake, Client hello (1):
SSLv3, TLS handshake, Server hello (2):
SSLv3, TLS handshake, CERT (11):
SSLv3, TLS handshake, Request CERT (13):
SSLv3, TLS handshake, Server finished (14):
SSLv3, TLS handshake, CERT (11):
SSLv3, TLS handshake, Client key exchange (16):
SSLv3, TLS handshake, CERT verify (15):
SSLv3, TLS change cipher, Client hello (1):
SSLv3, TLS handshake, Finished (20):
SSLv3, TLS change cipher, Client hello (1):
SSLv3, TLS handshake, Finished (20):
SSL connection using AES256-SHA
* Server certificate:
* subject: /O=dutchgrid/O=hosts/OU=nikhef.nl/CN=grasveld.nikhef.nl
* start date: 2010-09-27 00:00:00 GMT
* expire date: 2011-09-27 14:46:26 GMT
* subjectAltName: grasveld.nikhef.nl matched
* issuer: /C=NL/O=NIKHEF/CN=NIKHEF medium-security certification auth
* SSL certificate verify ok.
> GET / HTTP/1.1
> User-Agent: curl/7.15.5 (x86_64-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
> Host: grasveld.nikhef.nl:9000
> Accept: */*
>
< HTTP/1.1 200 OK
This should be fixed in curl-7.21.3-7.fc15. Fedora 13 is EOL: http://fedoraproject.org/wiki/End_of_life I see it works on FC14 and on Scientific Linux 6, with one note: it seems that curl wants to read ALL files in whatever path you specify for --ca-path, whereas the openssl build of curl only reads on the .0 and .r0 files (the latter is the correct behaviour, IIRC). The annoying thing about this is that the behaviour of curl is now depending on how it is linked (i.e. using NSS or using OpenSSL); when scripting things using curl I now have to determine how curl is linked first. (In reply to comment #3) > I see it works on FC14 and on Scientific Linux 6, with one note: it seems that > curl wants to read ALL files in whatever path you specify for --ca-path, > whereas the openssl build of curl only reads on the .0 and .r0 files (the > latter is the correct behaviour, IIRC). Yes, it goes through all files in the given directory and if it encounters a file that cannot be opened or loaded, it ignores the error. The only problem I am aware of is that NSS leaks memory when handling those errors. Vote for bug 734760 if you need this fixed (patch already there). > The annoying thing about this is that the behaviour of curl is now depending on > how it is linked (i.e. using NSS or using OpenSSL); when scripting things using > curl I now have to determine how curl is linked first. That should not be necessary unless you are using features that are specific to a particular SSL backend. |