Hello i want to use an API for a website but there an error with my curl command.
I want to disable SSL certificate verification.
curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: https://curl.haxx.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
Zach Smith
8,11713 gold badges56 silver badges127 bronze badges
asked Feb 27, 2018 at 15:41
2
Simply add the -k switch somewhere before the url.
Disclaimer: Use this at your own risk.
man curl | less +/--insecure
-k, —insecure
(TLS) By default, every SSL connection curl makes is verified to be secure. This option allows curl to proceed and operate
even for server connections otherwise considered insecure.The server connection is verified by making sure the server’s certificate contains the right name and verifies successfully
using the cert store.See this online resource for further details:
https://curl.haxx.se/docs/sslcerts.htmlSee also —proxy-insecure and —cacert
answered Feb 27, 2018 at 15:46
Gilles QuenotGilles Quenot
164k38 gold badges219 silver badges215 bronze badges
4
I am developing and I need to access https://localhost. I know the certificate will not match. I just want curl to ignore that. Currently it gives me the following error message:
curl: (51) SSL peer certificate or SSH remote key was not OK
Is it possible to tell curl to perform the access anyway?
asked Jan 16, 2013 at 23:09
1
Yeah, you can do that. From curl --help or man curl:
-k, --insecure(SSL) This option explicitly allows curl to perform «insecure» SSL
connections and transfers. All SSL connections are attempted to be
made secure by using the CA certificate bundle installed by default.
This makes all connections considered «insecure» fail unless -k,
—insecure is used.See this online resource for further details:
http://curl.haxx.se/docs/sslcerts.html
answered Jan 16, 2013 at 23:11
7
curl -k or curl --insecure does NOT fix this particular error condition:
curl: (51) SSL peer certificate
answered Jun 28, 2014 at 21:04
user228425user228425
2012 silver badges2 bronze badges
1
If you truly want to disable curl SSL verification, by default, for ALL use cases, you can do as suggested in this Unix stack exchange answer:
$ echo insecure >> ~/.curlrc
Now should you do this? No, as this is avoiding security checks you should have in place… but if you really really want to do this, caveat emptor!
answered Jul 22, 2020 at 20:15
Brad ParksBrad Parks
70413 silver badges20 bronze badges
cURL, by default, will ensure each SSL connection is secure by verifying the server’s SSL certificate. You’ll get SSL error when running cURL against https-based websites with SSL certificates that are either misconfigured, expired, or self-signed.
$ curl https://www.example.com/ curl: (51) Unable to communicate securely with peer: requested domain name does not match the server's certificate. curl: (60) SSL: no alternative certificate subject name matches target host name 'www.example.com' More details here: https://curl.haxx.se/docs/sslcerts.html curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: https://curl.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above.
You can force cURL to ignore SSL certificate errors by using the insecure option. The option will skip the SSL verification process, and you’ll be able to bypass any SSL error that a site might have while still having SSL-encrypted communication.
Ignoring SSL errors is, of course, not a secure method but is helpful if you trust the website, which may or may not be owned by you. This is equivalent to using —no-check-certificate option in wget.
Steps to disable SSL certificate verification in cURL:
-
Run curl against website with SSL error.
$ curl https://www.example.com/ curl: (51) Unable to communicate securely with peer: requested domain name does not match the server's certificate.
-
Use insecure option for curl to ignore SSL certificate error.
$ curl --insecure https://www.example.com/ <html> <head> <meta HTTP-EQUIV="REFRESH" content="0; url=/newpage.php"> </head> </html>
-k, --insecure (TLS) By default, every SSL connection curl makes is verified to be secure. This option allows curl to proceed and operate even for server connections otherwise considered insecure. The server connection is verified by making sure the server's certificate contains the right name and verifies successfully using the cert store. See this online resource for further details: https://curl.haxx.se/docs/sslcerts.html See also --proxy-insecure and --cacert. -
Use shortform insecure option for curl.
$ curl -k https://www.example.com/ <html> <head> <meta HTTP-EQUIV="REFRESH" content="0; url=/newpage.php"> </head> </html>
-
Add insecure to curl config file to apply the option to every SSL connection.
$ echo "insecure" >> ~/.curlrc
Only use this method in development setting or wherever security is not critical.
-
Test against problematic https website again without specifying insecure option.
$ curl https://www.example.com/ <html> <head> <meta HTTP-EQUIV="REFRESH" content="0; url=/newpage.php"> </head> </html>
Discuss the article:
Comment anonymously. Login not required.
Adding to user3258557 ‘s answer, let’s say that you need to test some fake server of your own with your own root CA etc. And you just don’t want to use curl’s -k option.
First, let’s create a RSA key for your Root CA:
openssl genrsa -des3 -out rootCA.key 4096
Then, using that key, let’s sign a certificate for our own CA:
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.crt
Now, you have a Root CA with private Key and Certificate.
Let’s now generate keys and certificates for our own websites:
openssl genrsa -out mainsite.net.key 2048
Now, before creating the certificate, we will need a Certificate Signing Request (CSR) first. Then our Root CA will «sign» the CSR and generate the certificate for our website.
openssl req -new -key mainsite.net.key -out mainsite.net.csr
Let’s finally create the certificate for our website:
openssl x509 -req -in mainsite.net.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out mainsite.net.crt -days 500 -sha256
For ease of use, let’s generate a .pem file using our .crt and .key files as:
cat mainsite.net.key mainsite.net.crt > mainsite.net.pem
Now, you can run a simple server with this .pem file. Say this server is running at 127.0.0.1:12345
For curl request, you can just do this:
curl --cacert "rootCA.crt" https://127.0.0.1:12345/
Going a step further, if you want to host multiple sites on a port using SNI, you can generate the key for each site, sign the CSR’s and use a curl request like below:
curl --resolve subsite1.mainsite.net:12345:127.0.0.1 -X GET --cacert "rootCA.crt" --cert "subsite1.mainsite.net.crt" --key "subsite1.mainsite.net.key" https://subsite1.mainsite.net:12345/