46

I am using curl to download data from a https site using public certificate files.

System information:

  • OS: fedora 14
  • curl: curl 7.30.0
  • openssl: OpenSSL 1.0.0a-fips

The command is,

curl -v "https://<ip:<port>" --cert "./cert.pem" --cacert "./cacert.pem" --cert-type PEM
* About to connect() to kng.com port 443 (#0)
*   Trying 11.19.37.123...
* Adding handle: conn: 0x8189e68
* Adding handle: send: 0
* Adding handle: recv: 0
* Curl_addHandleToPipeline: length: 1
* - Conn 0 (0x8189e68) send_pipe: 1, recv_pipe: 0
* Connected to fkng.com (11.19.37.123) port 443 (#0)
* unable to set private key file: './cert.pem' type PEM
* Closing connection 0
curl: (58) unable to set private key file: './cert.pem' type PEM

I have have given all the permission to the .pem file, still curl is throwing an error.

5 Answers 5

33

After reading cURL documentation on the options you used, it looks like the private key of certificate is not in the same file. If it is in different file, you need to mention it using --key file and supply passphrase.

So, please make sure that either cert.pem has private key (along with the certificate) or supply it using --key option.

Also, this documentation mentions that Note that this option assumes a "certificate" file that is the private key and the private certificate concatenated!

How they are concatenated? It is quite easy. Put them one after another in the same file.

You can get more help on this here.

I believe this might help you.

11
  • Thanks for your valuable information..Still one thing i dont understand is how can i retrieve private key from the public certificate. i can get public key "openssl x509 < testcert.pem -pubkey -noout" using this command ,and do the authentication with https url somthing like this ,curl "https://" --cert "./testcert.pem" --cacert "./cacert.pem" --pubkey "./testkey.pem" --cert-type PEM....When i hit this same url using mozill browser it is able to show me the same .pem file. May 18, 2013 at 19:15
  • Public key certificate does not contain private key. Private key is to be securely kept by the owner. If you do not have private key, you are not the owner of the certificate. May 18, 2013 at 19:16
  • Actually this public certificate is given by another server to download the data from their https url..Is it possible to download the data using the public certificate from the https url.Incase if you give me your HTTPS url to download the data every time what are the credentials required to see https page content. May 18, 2013 at 19:21
  • Is this certificate issued to your for a certificate signing request (CSR)? What is the purpose of this certificate? May 18, 2013 at 19:23
  • 1
    If the connection is asking for the certificate, then it needs private key to sign the data by which server can verify that the certificate belongs to the client. If firefox able to use the certificate, it must have private key. You can export the private key and make use of it. May 18, 2013 at 19:38
15

I faced this issue when I had used Open SSL and the solution was to split the cert in 3 files and use all of them doing the call with Curl:

openssl pkcs12 -in mycert.p12 -out ca.pem -cacerts -nokeys
openssl pkcs12 -in mycert.p12 -out client.pem -clcerts -nokeys 
openssl pkcs12 -in mycert.p12 -out key.pem -nocerts

curl --insecure --key key.pem --cacert ca.pem --cert client.pem:KeyChoosenByMeWhenIrunOpenSSL https://thesite
3
  • hmm. sure that its on the client.pem you set your password?
    – Philip
    Dec 5, 2017 at 17:06
  • 4
    Dude, you used --insecure which means you are not actually using the .pem :|
    – ALUFTW
    Jul 25, 2021 at 9:02
  • @ALUFTW --insecure disables verification of server certificates. It shouldn't affect client certificates, so client.pem is used. Though I guess the ca.pem is probably ignored when using --insecure
    – kapex
    Nov 9, 2022 at 15:41
15

I had the same issue, eventually I found a solution that works without splitting the file, by following Petter Ivarrson's answer

My problem was when converting .p12 certificate to .pem. I used:

openssl pkcs12 -in cert.p12 -out cert.pem

This converts and exports all certificates (CA + CLIENT) together with a private key into one file.

The problem was when I tried to verify if the hashes of certificate and key are matching by running:

// Get certificate HASH
openssl x509 -noout -modulus -in cert.pem | openssl md5

// Get private key HASH
openssl rsa -noout -modulus -in cert.pem | openssl md5

This displayed different hashes and that was the reason CURL failed. See here: https://michaelheap.com/curl-58-unable-to-set-private-key-file-server-key-type-pem/

I guess that was because all certificates are inside a file (CA + CLIENT) and CURL takes CA certificate instead of CLIENT one. Because CA is first in the list.

So the solution was to export only CLIENT certificate together with private key:

openssl pkcs12 -in cert.p12 -out cert.pem -clcerts
``

Now when I re-run the verification:
```sh
openssl x509 -noout -modulus -in cert.pem | openssl md5
openssl rsa -noout -modulus -in cert.pem | openssl md5

HASHES MATCHED !!!

So I was able to make a curl request by running

curl -ivk --cert ./cert.pem:KeyChoosenByMeWhenIrunOpenSSL https://thesite.com

without problems!!! 😀

That being said... I think the best solution is to split the certificates into separate file and use them separately like Petter Ivarsson wrote:

curl --insecure --key key.pem --cacert ca.pem --cert client.pem:KeyChoosenByMeWhenIrunOpenSSL https://thesite.com
4

I have a similar situation, but I use the key and the certificate in different files.

in my case you can check the matching of the key and the lock by comparing the hashes (see https://michaelheap.com/curl-58-unable-to-set-private-key-file-server-key-type-pem/). This helped me to identify inconsistencies.

2

Im not sure If this will help anyone but I was getting this error (although I was using php to create it instead of the command line) and to fix it I had to ensure that no old .key or .pem files were in the directory I was looking at. By deleting them and making fresh files with the authentication it worked perfectly!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.