cURL segfaults when connecting https web application but wget can connect

Question

I've set up a server using Jetty and SSL. I am using a self-signed server certificate for the client and server. This all works fine when I try to hit it with wget. My problem comes when I'm trying to hit it using curl:

$ curl -k --cert ./mycert-001.pem --key ./mykey-001.pem https://****:9994/rest/list --verbose
* About to connect() to server port 9994 (#0)
*   Trying ****...
* Connected to server(****) port 9994 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* skipping SSL peer certificate verification
* NSS: client certificate from file
*       subject: CN=foo,OU=bar,O=baz,L=Default City,C=US
*       start date: Nov 29 18:50:58 2016 GMT
*       expire date: Nov 29 18:50:58 2019 GMT
*       common name: foo
*       issuer: CN=foo,OU=bar,O=baz,L=Default City,C=US
Segmentation fault

Then when I try with wget:

$ wget --certificate=mycert-001.pem --private-key=mykey-001.pem --no-check-certificate --auth-no-challenge https://****:9994/rest/list
--2017-04-14 15:50:20--  https://****:9994/rest/list
Resolving **** (****)... *****
Connecting to ***** (****)|****|:9994... connected.
WARNING: cannot verify ****'s certificate, issued by ‘/C=US/ST=FOO/L=Default/O=FOO/OU=FOO/CN=FOO’:
  Self-signed certificate encountered.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/json]
Saving to: ‘list.5’

    [ <=>                                                  ] 58          --.-K/s   in 0s

2017-04-14 15:50:20 (3.47 MB/s) - ‘list.5’ saved [58]

Am I missing an option on curl to get this to work?

Answer 1

A core program like curl should never just crash as expected behavior. You've hit a bug.

Things you can try (this is now a troubleshooting question):

• Try updating your distro packages (apt update && apt full-upgrade, or your distro equivalent since you didn't say what distro/version you're using)
• Try upgrading your distro to a newer release
• Look for alternative packages that have curl compiled against a different TLS library than NSS (maybe OpenSSL, PolarSSL, or GnuTLS)
• Compile a new version of curl yourself
• Look for a container image of a newer OS or grab a Flatpak with a different version of curl or compiled with a different TLS library

...etc.