cURL and default CApath / CAcert

1

I am dealing with a baffling situation regarding cURL and its CApath and CAcert values, as cURL behaves differently for two users on the same system (SUSE 11 SLES).

For the first user, cURL fails, and its output shows CAfile is set, but CApath is not. For the second user, it is the opposite, and cURL works.

Neither user has a .curlrc file (unless it has a different name, I tried a find on ".curlrc"). Issuing "curl-config --ca" returns nothing for both users. "which curl" gives /usr/bin/curl for both users. I did not see any difference on .bashrc or .bash_profile between the users.

What may be the cause of such behavior?

EDIT: as I was ready to post my question, I noticed one cURL is using TLSv1, while the other, SSLv3. Maybe this is the cause of the problem? Even so, I do not see a reason for the different behavior.

First user:

> curl -v -L https://github.com/arq5x/lumpy-sv/archive/0.2.13.tar.gz -o lumpy-sv-0.2.13.tar.gz
*   Trying 192.30.253.113...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Connected to github.com (192.30.253.113) port 443 (#0)
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* TLSv1.0 (OUT), TLS handshake, Client hello (1):

[more output]

* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate

For the second user:

> curl -v -L https://github.com/arq5x/lumpy-sv/archive/0.2.13.tar.gz -o lumpy-sv-0.2.13.tar.gz
* About to connect() to github.com port 443 (#0)
*   Trying 192.30.253.113... connected
* Connected to github.com (192.30.253.113) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs/
* SSLv3, TLS handshake, Client hello (1):

[more output, download successful]

h.mon

Posted 2016-12-01T19:07:06.990

Reputation: 11

No answers