I'm trying to set up a Docker image that has our internal CA certificates installed so that users across the organization can make secure requests to intranet sites. We have a few different CAs that are used by different groups inside the organization. I'm trying to figure out which CA signed a particular certificate, becuase I cannot seem to get it trusted. In the browser on my laptop, the certificate is fully trusted, but when I try to make a request with cURL in the docker image, I get the following error:

curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

I'd really like to avoid telling people to just use -k. I have tried installing the known CAs in multiple locations, and using the --cacert option on a bundle file. Is it possible using a browser or other utility to export the CA that was used to sign a certificate?


Is it possible using a browser or other utility to export the CA that was used to sign a certificate?

The root CA certificate which is responsible for a leaf certificate is usually not sent within the TLS handshake. If you already have the CA locally installed in the browser you can export it there (details depend on the browser) but if it is unknown to the browser or system this is not possible. All you can get is the name of the issuer from looking at the issued certificate and then you have to find out where in your infrastructure the certificate has been issued and what root CA was responsible for this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.