libcurl ignores default buildroot CA bundle

Hello Buildroot community,

I have a STM32MP1 target and my buildroot image has both the curl and ca-certificates package installed. However, curl fails to authenticate any https requests:

# curl https://google.com

curl: (77) CA signer not available for verification

Do I need to do some extra buildroot configuration for libcurl to use the CA bundle in /etc/ssl/certs?

Thanks,

Dimi Tomov
--
Founder of TPM.dev
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Hello Baruch,

I may have found an issue with the libcurl package.

The libcurl.mk file lacks CA path when built with wolfssl instead of openssl.

ifeq ($(BR2_PACKAGE_LIBCURL_WOLFSSL),y) LIBCURL_CONF_OPTS += --with-wolfssl=$(STAGING_DIR)/usr LIBCURL_DEPENDENCIES += wolfssl
else
LIBCURL_CONF_OPTS += --without-wolfssl
endif

I tried adding LIBCURL_CONF_OPTS += --with-ca-path=/etc/ssl/certs in the above if case and rebuild, but this did not solve the issue. Could you please take a look?

Thanks,

Dimi

Quoted 24 lines · Dimi Tomov

Hello Buildroot community,

I have a STM32MP1 target and my buildroot image has both the curl and ca-certificates package installed. However, curl fails to authenticate any https requests:

# curl https://google.com

curl: (77) CA signer not available for verification

Do I need to do some extra buildroot configuration for libcurl to use the CA bundle in /etc/ssl/certs?

Thanks,

Dimi Tomov
--
Founder of TPM.dev
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Hell Martin and Baruch,

Issue persist after building my buildroot image with libcurl and openssl as a cryptographic provider, ca-certificates package installed properly and in default location. Error message only changed a bit:

# curl https://google.com
curl: (60) SSL certificate problem: certificate is not yet valid
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above.

^the above page mentions that a CA bundle is missing.

However, /etc/ssl/certs is deployed properly by the buildroot make and sdcard image.

Any ideas?

Thanks,

Dimi

--
Founder of TPM.dev

Quoted 17 lines · Dimi Tomov

Hello Baruch,

I may have found an issue with the libcurl package.

The libcurl.mk file lacks CA path when built with wolfssl instead of openssl.

ifeq ($(BR2_PACKAGE_LIBCURL_WOLFSSL),y) LIBCURL_CONF_OPTS += --with-wolfssl=$(STAGING_DIR)/usr LIBCURL_DEPENDENCIES += wolfssl
else
LIBCURL_CONF_OPTS += --without-wolfssl
endif

I tried adding LIBCURL_CONF_OPTS += --with-ca-path=/etc/ssl/certs in the above if case and rebuild, but this did not solve the issue. Could you please take a look?

Quoted 29 lines

Thanks,

Dimi

Quoted 24 lines · Dimi Tomov

Hello Buildroot community,

I have a STM32MP1 target and my buildroot image has both the curl and ca-certificates package installed. However, curl fails to authenticate any https requests:

# curl https://google.com

curl: (77) CA signer not available for verification

Do I need to do some extra buildroot configuration for libcurl to use the CA bundle in /etc/ssl/certs?

Thanks,

Dimi Tomov
--
Founder of TPM.dev
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

I forgot to mention that I have updated the system clock using data & hwclock -wu and the issue with libcurl and ca-certificates packages persists.

Quoted 79 lines · Dimi Tomov

Hell Martin and Baruch,

Issue persist after building my buildroot image with libcurl and openssl as a cryptographic provider, ca-certificates package installed properly and in default location. Error message only changed a bit:

# curl https://google.com
curl: (60) SSL certificate problem: certificate is not yet valid
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above.

^the above page mentions that a CA bundle is missing.

However, /etc/ssl/certs is deployed properly by the buildroot make and sdcard image.

Any ideas?

Thanks,

Dimi

--
Founder of TPM.dev

Quoted 17 lines · Dimi Tomov

Hello Baruch,

I may have found an issue with the libcurl package.

The libcurl.mk file lacks CA path when built with wolfssl instead of openssl.

ifeq ($(BR2_PACKAGE_LIBCURL_WOLFSSL),y) LIBCURL_CONF_OPTS += --with-wolfssl=$(STAGING_DIR)/usr LIBCURL_DEPENDENCIES += wolfssl
else
LIBCURL_CONF_OPTS += --without-wolfssl
endif

I tried adding LIBCURL_CONF_OPTS += --with-ca-path=/etc/ssl/certs in the above if case and rebuild, but this did not solve the issue. Could you please take a look?

Quoted 29 lines

Thanks,

Dimi

Quoted 24 lines · Dimi Tomov

Hello Buildroot community,

I have a STM32MP1 target and my buildroot image has both the curl and ca-certificates package installed. However, curl fails to authenticate any https requests:

# curl https://google.com

curl: (77) CA signer not available for verification

Do I need to do some extra buildroot configuration for libcurl to use the CA bundle in /etc/ssl/certs?

Thanks,

Dimi Tomov
--
Founder of TPM.dev
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

I think I found another issue:

$make libcurl-reconfigure does not change the cryptopgrahic provider for curl.

I change the option using make menuconfig and I see it reflected in my buildroot config.

ps: about curl w/ openssl, my board had its date set to May instead of June and this was the issue.

Thanks,

Dimi

Quoted 84 lines · Dimi Tomov

I forgot to mention that I have updated the system clock using data & hwclock -wu and the issue with libcurl and ca-certificates packages persists.

Quoted 79 lines · Dimi Tomov

Hell Martin and Baruch,

Issue persist after building my buildroot image with libcurl and openssl as a cryptographic provider, ca-certificates package installed properly and in default location. Error message only changed a bit:

# curl https://google.com
curl: (60) SSL certificate problem: certificate is not yet valid
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above.

^the above page mentions that a CA bundle is missing.

However, /etc/ssl/certs is deployed properly by the buildroot make and sdcard image.

Any ideas?

Thanks,

Dimi

--
Founder of TPM.dev

Quoted 17 lines · Dimi Tomov

Hello Baruch,

I may have found an issue with the libcurl package.

The libcurl.mk file lacks CA path when built with wolfssl instead of openssl.

ifeq ($(BR2_PACKAGE_LIBCURL_WOLFSSL),y) LIBCURL_CONF_OPTS += --with-wolfssl=$(STAGING_DIR)/usr LIBCURL_DEPENDENCIES += wolfssl
else
LIBCURL_CONF_OPTS += --without-wolfssl
endif

I tried adding LIBCURL_CONF_OPTS += --with-ca-path=/etc/ssl/certs in the above if case and rebuild, but this did not solve the issue. Could you please take a look?

Quoted 29 lines

Thanks,

Dimi

Quoted 24 lines · Dimi Tomov

Hello Buildroot community,

I have a STM32MP1 target and my buildroot image has both the curl and ca-certificates package installed. However, curl fails to authenticate any https requests:

# curl https://google.com

curl: (77) CA signer not available for verification

Do I need to do some extra buildroot configuration for libcurl to use the CA bundle in /etc/ssl/certs?

Thanks,

Dimi Tomov
--
Founder of TPM.dev
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

make libcurl-dirclean forced a rebuild with wolfssl as the crypto backend, however --with-ca-path does not work. Error below:

checking default CA cert bundle/path... configure: error:
--with-ca-path only works with OpenSSL, GnuTLS or mbedTLS

How to enable buildroot CA bundle for libcurl when using wolfssl?

Thanks,
Dimi

Quoted 99 lines · Dimi Tomov

I think I found another issue:

$make libcurl-reconfigure does not change the cryptopgrahic provider for curl.

I change the option using make menuconfig and I see it reflected in my buildroot config.

ps: about curl w/ openssl, my board had its date set to May instead of June and this was the issue.

Thanks,

Dimi

Quoted 84 lines · Dimi Tomov

I forgot to mention that I have updated the system clock using data & hwclock -wu and the issue with libcurl and ca-certificates packages persists.

Quoted 79 lines · Dimi Tomov

Hell Martin and Baruch,

Issue persist after building my buildroot image with libcurl and openssl as a cryptographic provider, ca-certificates package installed properly and in default location. Error message only changed a bit:

# curl https://google.com
curl: (60) SSL certificate problem: certificate is not yet valid
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above.

^the above page mentions that a CA bundle is missing.

However, /etc/ssl/certs is deployed properly by the buildroot make and sdcard image.

Any ideas?

Thanks,

Dimi

--
Founder of TPM.dev

Quoted 17 lines · Dimi Tomov

Hello Baruch,

I may have found an issue with the libcurl package.

The libcurl.mk file lacks CA path when built with wolfssl instead of openssl.

ifeq ($(BR2_PACKAGE_LIBCURL_WOLFSSL),y) LIBCURL_CONF_OPTS += --with-wolfssl=$(STAGING_DIR)/usr LIBCURL_DEPENDENCIES += wolfssl
else
LIBCURL_CONF_OPTS += --without-wolfssl
endif

I tried adding LIBCURL_CONF_OPTS += --with-ca-path=/etc/ssl/certs in the above if case and rebuild, but this did not solve the issue. Could you please take a look?

Quoted 29 lines

Thanks,

Dimi

Quoted 24 lines · Dimi Tomov

Hello Buildroot community,

I have a STM32MP1 target and my buildroot image has both the curl and ca-certificates package installed. However, curl fails to authenticate any https requests:

# curl https://google.com

curl: (77) CA signer not available for verification

Do I need to do some extra buildroot configuration for libcurl to use the CA bundle in /etc/ssl/certs?

Thanks,

Dimi Tomov
--
Founder of TPM.dev
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot