I am trying to connect to a site behind a firewall, that is why I cannot share the URL for verification.
$ curl -vvvv https://example.com:8080/foo/ba/?wsdl --cacert /tmp/cacert-2018-12-05.pem * Trying a.b.c.d... * TCP_NODELAY set * Connected to example.com (a.b.c.d) port 8080 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /tmp/cacert-2018-12-05.pem CApath: /etc/ssl/certs * (304) (OUT), TLS handshake, Client hello (1): * (304) (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (OUT), TLS alert, Server hello (2): * SSL certificate problem: unable to get local issuer certificate * stopped the pause stream! * Closing connection 0 curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: https://curl.haxx.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above.
How can that be?
Does it mean the intermediate cannot be pulled properly? But why does it work with the Browser?
And the "DigiCert Global Root G2" is in the cacert.pem I am using.
But not the Thawte TLS RSA CA G1.