Re: [IBMiOSS] curl SSL error (60)

Years ago we had issues with curl on the PHP server.

In trying to configure it I found some items were configured to use
/QOpenSys/QIBM/ProdData/SC1/OpenSSL/certs
And others were configured to use locations based on the open ssl version installed, like this:
/usr/local/openssl-1.0.2j/ssl/certs

Every time a SSL PTF was applied it the certs kept getting reset or changing.

In the end I started using UserData folder because it never gets overwritten by PTFs.
That’s where the folder came from in my reply to your question.
/QOpenSys/QIBM/UserData/SC1/OpenSSL/certs


To get it all to work, I would generate a cert.pem file based on current world certs from places like:
https://curl.haxx.se/ca/cacert.pem
https://pki.google.com/roots.pem

That new cert.pem file would be placed
/QOpenSys/QIBM/UserData/SC1/OpenSSL/cert.pem

And then we would update the settings to use that location.

When we got curl installed in pase I had similar cert issues.
I ended up figuring out how to just pass that cert location to the command, and it works.

curl -v "https://www.midrange.com"; --cacert /QOpenSys/QIBM/UserData/SC1/OpenSSL/cert.pem --capath /QOpenSys/QIBM/UserData/SC1/OpenSSL/certs


That’s the little more of the background from the information I provided.


I was just showing you how to pass your own pem file into the curl command.

Like Pete had mentioned “a way to point to the location of the CA certs when you ran the command”.


My server doesn’t have the folder: “/QOpenSys/etc/ssl/certs”

But we are still on V7R3.
Does that get created automatically on V7R4 or did something else run to manually create it?

Has IBM finally unified the many places you have to deal with to get certs working?

--
Chris Hiebert
Senior Programmer/Analyst
Disclaimer: Any views or opinions presented are solely those of the author and do not necessarily represent those of the company.

From: OpenSource <opensource-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Brad Stone
Sent: Friday, September 23, 2022 1:46 PM
To: IBMi Open Source Roundtable <opensource@xxxxxxxxxxxxxxxxxx>
Subject: Re: [IBMiOSS] curl SSL error (60)



Clear as mud. :)



I got it installed and it shows blanks for curl-config --ca



Now, I show that certs are stored in /QOpenSys/etc/ssl/certs. However in a

previous post it said to set the ca path to

/QOpenSys/QIBM/UserData/SC1/OpenSSL/certs which is empty on my system

(V7R4).