I'm trying to set up a Docker image that has our internal CA certificates installed so that users across the organization can make secure requests to intranet sites. We have a few different CAs that are used by different groups inside the organization. I'm trying to figure out which CA signed a particular certificate, becuase I cannot seem to get it trusted. In the browser on my laptop, the certificate is fully trusted, but when I try to make a request with cURL in the docker image, I get the following error:
curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: https://curl.haxx.se/docs/sslcerts.html curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option. If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL). If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option.
I'd really like to avoid telling people to just use
-k. I have tried installing the known CAs in multiple locations, and using the
--cacert option on a bundle file. Is it possible using a browser or other utility to export the CA that was used to sign a certificate?