Using curl -with --cert

Question

I'm using cUrl to request data from a corporate website site using a .cer certificate that they sent me. This is the command:

cUrl --header "Content-Type: text/xml;charset=UTF-8" \
     --data @bustaRequestISEE2015ConsultazioneAttestazione.xml \
     -o bustaResponseISEE2015ConsultazioneAttestazione.xml \
     --cert ./caaffabisrl.cer \
     https://istitutonazionaleprevidenzasociale.spcoop.gov.it/PD

When I run it, I get this error message:

curl: (58) could not load PEM client certificate, OpenSSL error error:0906D06C:PEM routines:PEM_read_bio:no start line, (no key found, wrong pass phrase, or wro ng file format?)

Is there anybody who can help me?

Tks, Cristiano.

Solution 1

It is not possible to connect to a TLS server with curl using only a client certificate, without the client private key. Either they forgot to send you the private key file, or, what they sent you was not the client certificate but the server certificate for verification.

The first thing I would try is using --cacert instead of --cert. That is, tell curl that this is the server's certificate that curl can use to verify that the server is who you think it is.

You can also try removing --cert and not using --cacert, and you will probably get an error that the server is not trusted. Then add the --insecure argument and see if that works. I would not keep that argument, as then you have no proof of who you are talking to.

My guess is that it is the server cert, and that using --cacert instead of --cert will solve the problem.

Solution 2

My guess is that your certificate file is a DER encoded binary certificate instead of base-64 encoded certificate. To covert the from binary to base-64, you can use OpenSSL.

openssl x509 -inform der -in certificate.cer -out certificate.pem

I always forget all the arguments and have the following site bookmarked, as it gives examples of how to convert pretty much any certificate format. https://www.sslshopper.com/ssl-converter.html

Comments

[Cristiano Ansaloni]

Thanks @kah608, I converted the certificate as you suggest but now I get this error message: curl: (58) unable to set private key file: './caaffabisrl.pem' type PEM. Can you help me?

[kah608]

@CristianoAnsaloni It is hard to know exactly why this is happening. Take a look at this website, it has more information and troubleshooting steps: honglus.blogspot.in/2012/03/…

[Kevin Won]

had same error response, change to --cacert fixed it.

[C-lio Garcia]

Changing to --cacert i have the following error: curl: (35) error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure

[Sazzad Hissain Khan]

@kah608 do you know why I am getting this error? stackoverflow.com/q/60754143/1084174