#595 Problems with SSL certificate: Can't authenticate CA

[elmentz]

When trying to use esniper recently (both on arch linux and ubuntu), I get the following error:

`Auction [redacted]: Cannot connect to URL �{�: Peer certificate cannot be authenticated with known CA certificates: SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Retrying...`

I've tried to pin down the issue, believing there must be an error with my root certificates. I reinstalled all certificates directly from the curl website, did a `c_rehash` in my cert dir, but the problem persists.

Now, I am not sure whether this is a problem with curl itself, or a problem with esniper.
Running an strace on esniper, reveals that it looks for two files in my certificates directory, of which it can't find the second one.

`stat("/etc/ssl/certs/415660c1.0", {st_mode=S_IFREG|0644, st_size=834, ...}) = 0
open("/etc/ssl/certs/415660c1.0", O_RDONLY) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=834, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f5a77caf000
read(4, "-----BEGIN CERTIFICATE-----\nMIIC"..., 4096) = 834
read(4, "", 4096) = 0
close(4) = 0
munmap(0x7f5a77caf000, 4096) = 0
stat("/etc/ssl/certs/415660c1.1", 0x7fff016a5d40) = -1 ENOENT (No such file or directory)
write(3, "\25\3\1\0\2\0020", 7) = 7
close(3) = 0
write(2, "Auction 170767170223: Cannot con"..., 266) = 266
write(2, "Retrying...\n", 12) = 12
rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
rt_sigaction(SIGCHLD, NULL, {SIG_DFL, [], 0}, 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
nanosleep({2, 0}, {0, 733354911}) = ? ERESTART_RESTARTBLOCK (To be restarted)`

As you can see in above trace it seems that `/etc/ssl/certs/415660c1.1` can not be found.
This seems to be a persistent error, which other people have reported elsewhere. see here http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=624005#10 for an example.

It is beyond my skills to establish whether this is a problem with esniper or curl or simply my certificates. But I would highly appreciate any help.

Maybe I could suggest including an option in esniper config so that one could switch off curls ssl verfication via curls --insecure switch.
Thx much.

[Bodo]

try to use libcurl4-gnutls-dev instead of libcurl4-openssl-dev

see bug 3369299
http://sourceforge.net/tracker/index.php?func=detail&aid=3369299&group_id=45285&atid=442436

just wanted to confirm that bomm's suggestion worked perfectly.

$ dpkg --get-selections | grep curl
...
libcurl4-openssl-dev install

$ sudo apt-get install libcurl4-gnutls-dev
...
The following packages will be REMOVED:
libcurl4-openssl-dev

$ dpkg --get-selections | grep curl
...
libcurl4-gnutls-dev install

Rebuild esniper from cvs and no more CA errors.

[elmentz]

yes, it seems that using libcurl4-gnutls-dev works, at least esniper is able to login now. although i just had an unsuccessful bid, but i guess that it is not related (see automated bug report 3481275)

[Peter Simons]

Check whether your system has a file called "ca-bundle.crt" in /etc or /etc/ssl/certs or some other place. If it does, you have to apply the patch from bug report #3549789 to esniper and configure the environment variable CURL_CA_BUNDLE to point to that file before running esniper.

[DavidM]

Installing libcurl4-gnutls-dev seems to have fixed the problem for me as well. I did a clean build of esniper after installing it.