I am getting the following error using curl:
curl: (77) error setting certificate verify locations: CAfile: /etc/ssl/certs/ca-certificates.crt CApath: none
How do I set this certificate verify locations? Thanks.
I am getting the following error using curl:
curl: (77) error setting certificate verify locations: CAfile: /etc/ssl/certs/ca-certificates.crt CApath: none
How do I set this certificate verify locations? Thanks.
This error is related to a missing package: ca-certificates. Install it.
In Ubuntu Linux (and similar distro):
# apt-get install ca-certificates
In CygWin via Apt-Cyg
# apt-cyg install ca-certificates
In Arch Linux (Raspberry Pi)
# pacman -S ca-certificates
The documentation tells:
This package includes PEM files of CA certificates to allow SSL-based applications to check for the authenticity of SSL connections.
As seen at: Debian -- Details of package ca-certificates in squeeze
pacman -S ca-certificates-utils. I did.
– Mark Grimes
Sep 8 '16 at 20:23
sudo apt install --reinstall ca-certificates reinstalled the package and resolved the errors I was seeing
– Will
Aug 5 at 9:40
This fixed for me :
curl --remote-name --time-cond cacert.pem \
https://curl.haxx.se/ca/cacert.pem
I had the same problem.
That was my error
error setting ce
rtificate verify locations:
CAfile: D:/git_repo/mingw32/ssl/certs/ca-bundle.crt
CApath: none
It works fine for me
I rename the git installation directory name to git_repo".
Run following command in git bash that works fine for me
git config --global http.sslverify "false"
I had the exact same problem. As it turns out, my /etc/ssl/certs/ca-certificates.crt file was malformed. The last entry showed something like this:
-----BEGIN CERTIFICATE-----
MIIEDTCCAvWgAwIBAgIJAN..lots of certificate text....AwIBAgIJAN-----END CERTIFICATE-----
After adding a newline before -----END CERTIFICATE-----, curl was able handle the certificates file.
This was very annoying to find out since my update-ca-certificates command did not give me any warning.
This may or may not be a version specific problem of curl, so here is my version, just for completeness:
curl --version
# curl 7.51.0 (x86_64-alpine-linux-musl) libcurl/7.51.0 OpenSSL/1.0.2j zlib/1.2.8 libssh2/1.7.0
# Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
# Features: IPv6 Largefile NTLM NTLM_WB SSL libz TLS-SRP UnixSockets
It seems your curl points to a non-existing file with CA certs or similar.
For the primary reference on CA certs with curl, see: https://curl.haxx.se/docs/sslcerts.html
The error is due to corrupt or missing SSL chain certificate files in the PKI directory. You’ll need to make sure the files ca-bundle, following steps: In your console/terminal:
mkdir /usr/src/ca-certificates && cd /usr/src/ca-certificates
Enter this site: https://rpmfind.net/linux/rpm2html/search.php?query=ca-certificates , get your ca-certificate, for SO. Copy url of download and paste in url: wget your_url_donwload_ca-ceritificated.rpm now, install yout rpm:
rpm2cpio your_url_donwload_ca-ceritificated.rpm | cpio -idmv
now restart your service: my example this command:
sudo service2 httpd restart
@roens is correct. This affects all Anaconda users, with below error
curl: (77) error setting certificate verify locations:
CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
The workaround is to use the default system curl and avoid messing with the prepended Anaconda PATH variable. You can either
Rename the Anaconda curl binary :)
mv /path/to/anaconda/bin/curl /path/to/anaconda/bin/curl_anaconda
OR remove Anaconda curl
conda remove curl
$ which curl
/usr/bin/curl
[0] Anaconda Ubuntu curl Github issue https://github.com/conda/conda-recipes/issues/352
curl with the full path /usr/bin/curl
– jxramos
Nov 19 at 1:22
For what it's worth, checking which curl is being run is significant too.
A user on a shared machine I maintain had been getting this error. But the cause turned out to be because they'd installed Anaconda (http://continuum.io). Doing so put Anaconda's binary path before the standard $PATH, and it comes with its own curl binary, which had trouble finding the default certs that were installed on this Ubuntu machine.
which -a curl to see everything available, and of course noting which one comes on top.
– jxramos
Nov 19 at 1:23
Create a file ~/.curlrc with the following content
cacert=/etc/ssl/certs/ca-certificates.crt
For PHP code running on XAMPP on Windows I found I needed to edit php.ini to include the below
[curl]
; A default value for the CURLOPT_CAINFO option. This is required to be an
; absolute path.
curl.cainfo = curl-ca-bundle.crt
and then copy to a file https://curl.haxx.se/ca/cacert.pem and rename to curl-ca-bundle.crt and place it under \xampp path (I couldn't get curl.capath to work). I also found the CAbundle on the cURL site wasn't enough for the remote site I was connecting to, so used one that is listed with a pre-compiled Windows version of curl 7.47.1 at http://winampplugins.co.uk/curl/
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). The default
bundle is named curl-ca-bundle.crt; you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
for example
curl --insecure http://........
Another alternative to fix this problem is to disable the certificate validation:
echo insecure >> ~/.curlrc
The quickest way to get around the error is add on the -k option somewhere in your curl request. That option "allows connections to SSL cites without certs." (from curl --help)
Be aware that this may mean that you're not talking to the endpoint you think you are, as they are presenting a certificate not signed by a CA you trust.
For example:
$ curl -o /usr/bin/apt-cyg https://raw.github.com/cfg/apt-cyg/master/apt-cyg
gave me the following error response:
curl: (77) error setting certificate verify locations:
CAfile: /usr/ssl/certs/ca-bundle.crt
CApath: none
I added on -k:
curl -o /usr/bin/apt-cyg https://raw.github.com/cfg/apt-cyg/master/apt-cyg -k
and no error message. As a bonus, now I have apt-cyg installed. And ca-certificates.
-k flag means you're losing verification. Depending on your needs this may be acceptable. MITM are non-trivial attacks if you assume your network and the server you're communicating with are secured from interlopers (can you make that assumption?). The risk increases depending on the type of you data (sourcecode and certs are riskier than images). You can verify the integrity of the data after the transfer (checksums etc.) but now you're shifting your trust onto that checksum channel. In the end -k gives you quite a bit more work.
– Mark Fox
Mar 4 '14 at 20:12
Put this into your .bashrc
# fix CURL certificates path
export CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
(see comment from Robert)
I also had the newest version of ca-certificates installed but was still getting the error:
curl: (77) error setting certificate verify locations:
CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
The issue was that curl expected the certificate to be at the path /etc/pki/tls/certs/ca-bundle.crt but could not find it because it was at the path /etc/ssl/certs/ca-certificates.crt.
Copying my certificate to the expected destination by running
sudo cp /etc/ssl/certs/ca-certificates.crt /etc/pki/tls/certs/ca-bundle.crt
worked for me. You will need to create folders for the target destination if they do not exist by running
sudo mkdir -p /etc/pki/tls/certs
If needed, modify the above command to make the destination file name match the path expected by curl, i.e. replace /etc/pki/tls/certs/ca-bundle.crt with the path following "CAfile:" in your error message.
ln -s if don't want to re-copy it every time you update it.
– starbeamrainbowlabs
Aug 28 '15 at 8:41
rescuetime app on Fedora 25. sudo ln -s /etc/pki/tls/certs/ca-bundle.crt /etc/pki/tls/certs/ca-certificates.crt solved the problem. (CURL_CA_BUNDLE env var didn't work)
– GabLeRoux
Feb 14 '17 at 3:33
This worked for me
sudo apt-get install ca-certificates
then go into the certificates folder at
sudo cd /etc/ssl/certs
then you copy the ca-certificates.crt file into the /etc/pki/tls/certs
sudo cp ca-certificates.crt /etc/pki/tls/certs
From $ man curl:
--cert-type <type>
(SSL) Tells curl what certificate type the provided certificate
is in. PEM, DER and ENG are recognized types. If not specified,
PEM is assumed.
If this option is used several times, the last one will be used.
--cacert <CA certificate>
(SSL) Tells curl to use the specified certificate file to verify
the peer. The file may contain multiple CA certificates. The
certificate(s) must be in PEM format. Normally curl is built to
use a default file for this, so this option is typically used to
alter that default file.
Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?
ca-certificatesinstalled but the error persisted. The problem was that my certificates were located in/etc/ssl/certs/ca-certificates.crtinstead of/etc/pki/tls/certs/ca-bundle.crt, so I just had to set the environmental variableCURL_CA_BUNDLEto the correct path. – Robert Smith Dec 11 '14 at 4:28export CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt. – tidy Mar 18 '16 at 7:06