curl appears to be build against openssl:
$ curl -V
curl 7.18.1 (i686-pc-linux-gnu) libcurl/7.18.1 OpenSSL/0.9.8h zlib/1.2.3
but it does not seem to be set to use ca bundle:
$ curl-config --ca
$
ggl-gtk's error reads:
* Connected to clients2.google.com (64.233.183.102) port 443 (#0)
* SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
* Closing connection #0
* Peer certificate cannot be authenticated with known CA certificates
curl alone seems to give the save error (SSL3_GET_SERVER_CERTIFICATE):
$ curl https://desktop.google.com/desktop
curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). The default
bundle is named curl-ca-bundle.crt; you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
$
curl with path to ca bundle specified fails differently:
$ curl --capath /etc/ssl/certs/ https://desktop.google.com/desktop
curl: (51) SSL: certificate subject name 'www.google.com' does not match target host name 'desktop.google.com'
$
Does this mean that libcurl needs to have the capath set somehow? Or is the last error also unrecoverable?