【发布时间】：2017-11-30 15:05:13
【问题描述】：
当我在 CentOS 6（和 7）上发现 curl 的奇怪行为时，我一直在尝试配置新的专用服务器：
curl "https://google.com"
返回
curl (60): Peer certificate cannot be authenticated with known CA certificates
似乎 curl 对当前系统上安装的 CA 一无所知。
# curl https://google.com --verbose
* About to connect() to google.com port 443 (#0)
* Trying 172.217.25.174... connected
* Connected to google.com (172.217.25.174) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* Remote Certificate has expired.
* NSS error -8181
* Closing connection #0
* Peer certificate cannot be authenticated with known CA certificates
curl: (60) Peer certificate cannot be authenticated with known CA certificates
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
--insecure 对我不好。
我已经尝试过：
- 重新安装
ca-certificates, - 通过
update-ca-trust extract提取证书 - 下载第三方ca证书
- 甚至设置
--cacert选项来直接 curl 执行
但这对我没有帮助。
首先想到 - 好吧，新鲜的操作系统不能有实际版本的证书，但如果我这样做 yum update -y 怎么办？应该是真实的，不是吗？
我已经检查过以前提出的问题，例如 get-60-error-with-curl 和许多其他问题。
【问题讨论】：