Arch Linux

theherk

Member

Registered: 2013-09-22

Posts: 25

How does one trust/verify a self-signed cert?

I have a docker image that was spun up and is serving an api using a self-signed cert. I have that cert file.

When I curl that api, I must ignore verification. So I have added that cert to:

/etc/ca-certificates/trust-source/anchors

and run

trust extract-compat

This cert now shows in:

trust list

I don't know much on this topic, but should this now be treated as verified? I have done these things based on this news post and this bbs post. What am I doing wrong?

c0mm0ner

Member

Registered: 2015-11-09

Posts: 93

Re: How does one trust/verify a self-signed cert?

What is the actual problem you are running into?

theherk

Member

Registered: 2013-09-22

Posts: 25

Re: How does one trust/verify a self-signed cert?

I cannot curl without ignoring validation. I want it to be treated as valid.

c0mm0ner

Member

Registered: 2015-11-09

Posts: 93

Re: How does one trust/verify a self-signed cert?

Check if your connection works with

openssl s_client

to see if you've got a certificate or curls problem

theherk

Member

Registered: 2013-09-22

Posts: 25

Re: How does one trust/verify a self-signed cert?

The certificate given by the server in this case is correct, but I get:

Verify return code: 21 (unable to verify the first certificate)