HOME
LINUX

curl: (60) Peer’s Certificate issuer is not recognized. (SSL 인증서 점검)

admin 2023.09.20

SSL을 서버에 설치 진행하여 결과 테스트를 진행해보는데 간단하게 CURL 로 테스트 진행

[root@localhost ~]# curl --tlsv1.2 -I -v -L https://nginxtest.xinet.kr
* About to connect() to nginxtest.xinet.kr port 443 (#0)
*   Trying 112.175.245.208...
* Connected to nginxtest.xinet.kr (112.175.245.208) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* Server certificate:
*       subject: CN=nginxtest.xinet.kr
*       start date:  9월 20 00:39:45 2023 GMT
*       expire date: 12월 19 00:39:44 2023 GMT
*       common name: nginxtest.xinet.kr
*       issuer: CN=R3,O=Let's Encrypt,C=US
* NSS error -8179 (SEC_ERROR_UNKNOWN_ISSUER)
* Peer's Certificate issuer is not recognized.
* Closing connection 0
curl: (60) Peer's Certificate issuer is not recognized.
More details here: http://curl.haxx.se/docs/sslcerts.html

[root@localhost ~]# curl --tlsv1.2 -I -v -L https://nginxtest.xinet.kr

* About to connect() to nginxtest.xinet.kr port 443 (#0)

* Trying 112.175.245.208...

* Connected to nginxtest.xinet.kr (112.175.245.208) port 443 (#0)

* Initializing NSS with certpath: sql:/etc/pki/nssdb

* CAfile: /etc/pki/tls/certs/ca-bundle.crt

CApath: none

* Server certificate:

* subject: CN=nginxtest.xinet.kr

* start date: 9월 20 00:39:45 2023 GMT

* expire date: 12월 19 00:39:44 2023 GMT

* common name: nginxtest.xinet.kr

* issuer: CN=R3,O=Let's Encrypt,C=US

* NSS error -8179 (SEC_ERROR_UNKNOWN_ISSUER)

* Peer's Certificate issuer is not recognized.

* Closing connection 0

curl: (60) Peer's Certificate issuer is not recognized.

More details here: http://curl.haxx.se/docs/sslcerts.html

위와 같이 에러가 발생한다 원인이 뭔가 SSL 체크 사이트 한번 확인해보자 https://www.ssllabs.com/ssltest/index.html

B등급을 받고 This server’s certificate chain is incomplete. Grade capped to B. 표시가 된다 / chain 인증서가 잘못된다 표시
다른 사이트에서 테스트를 진행해보자

https://www.sslchecker.com/ 해당 사이트에서도 테스트를 진행해보면 정확하게 뭐가 문제인지 확인이 된다
디테일하게 보면 chain cert1 인증서와 root1 인증서가 만료되었다는 것을 확인 할수가 있다 (기본 도메인 인증서는 정상이지만 )

결국 인증서를 다시 작업해서 서버에 업로드 후 결과 값을 다시 확인

다시 curl 통신 test

[root@localhost ~]# curl --tlsv1.2 -I -v -L https://nginxtest.xinet.kr
*   Trying 112.175.245.208:443...
* Connected to nginxtest.xinet.kr (112.175.245.208) port 443
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/pki/tls/certs/ca-bundle.crt
*  CApath: none
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=nginxtest.xinet.kr
*  start date: Sep 20 05:57:18 2023 GMT
*  expire date: Oct 21 05:57:17 2024 GMT
*  subjectAltName: host "nginxtest.xinet.kr" matched cert's "nginxtest.xinet.kr"
*  issuer: C=BE; O=GlobalSign nv-sa; CN=AlphaSSL CA - SHA256 - G4
*  SSL certificate verify ok.
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://nginxtest.xinet.kr/
* [HTTP/2] [1] [:method: HEAD]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: nginxtest.xinet.kr]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.3.0]
* [HTTP/2] [1] [accept: */*]
> HEAD / HTTP/2

[root@localhost ~]# curl --tlsv1.2 -I -v -L https://nginxtest.xinet.kr

* Trying 112.175.245.208:443...

* Connected to nginxtest.xinet.kr (112.175.245.208) port 443

* ALPN: curl offers h2,http/1.1

* TLSv1.3 (OUT), TLS handshake, Client hello (1):

* CAfile: /etc/pki/tls/certs/ca-bundle.crt

* CApath: none

* TLSv1.3 (IN), TLS handshake, Server hello (2):

* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):

* TLSv1.3 (IN), TLS handshake, Certificate (11):

* TLSv1.3 (IN), TLS handshake, CERT verify (15):

* TLSv1.3 (IN), TLS handshake, Finished (20):

* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):

* TLSv1.3 (OUT), TLS handshake, Finished (20):

* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384

* ALPN: server accepted h2

* Server certificate:

* subject: CN=nginxtest.xinet.kr

* start date: Sep 20 05:57:18 2023 GMT

* expire date: Oct 21 05:57:17 2024 GMT

* subjectAltName: host "nginxtest.xinet.kr" matched cert's "nginxtest.xinet.kr"

* issuer: C=BE; O=GlobalSign nv-sa; CN=AlphaSSL CA - SHA256 - G4

* SSL certificate verify ok.

* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):

* old SSL session ID is stale, removing

* using HTTP/2

* [HTTP/2] [1] OPENED stream for https://nginxtest.xinet.kr/

* [HTTP/2] [1] [:method: HEAD]

* [HTTP/2] [1] [:scheme: https]

* [HTTP/2] [1] [:authority: nginxtest.xinet.kr]

* [HTTP/2] [1] [:path: /]

* [HTTP/2] [1] [user-agent: curl/8.3.0]

* [HTTP/2] [1] [accept: */*]

> HEAD / HTTP/2

ssl connection 정상적으로 통신 한것을 확인 할 수 있다
그럼 ssl 체크 사이트에서는 어떻게 나오는지 다시 확인

정상적으로 A등급을 받았으며

Chain 인증서, root 인증서도 정상적으로 나오는것을 확인 할수 있다

SSL 체크 사이트
https://www.ssllabs.com/ssltest/index.html
https://www.sslchecker.com/sslchecker
https://www.digicert.com/help/

상품명
주문번호
택배사
송장번호

시골청년의 엔지니어이야기 ( 진반장 )

curl: (60) Peer’s Certificate issuer is not recognized. (SSL 인증서 점검)

코멘트 쓰기 작성취소