title: Firefox can find certificate, but curl cannot (while tunneling https through ssh)
body: <h1>Background:</h1>
  
  <p>I have a running app at ports <code>8080</code> in the remote server and a https ingress proxy at <code>443</code> on the same server, which redirects everything to <code>8080</code> app after handling the SSL.</p>
  
  <h1>What I want to do:</h1>
  
  <p>I want to communicate with the app through SSL remotely, while not having access directly to this domain (it is on a local network, I can access the server remotely via a different domain).</p>
  
  <h1>What I did:</h1>
  
  <p>I tunneled 443 port from my remote server <code>ssh -L 3001:0.0.0.0:443 user@example.com</code>. I then added <code>127.0.0.1   example.com</code> to my <code>/etc/hosts</code> to make sure that the domain on my system is resolved properly.</p>
  
  <p>Now, what I <em>can</em> do is enter <code>https://example.com:3001/some/thing/</code> in firefox and it gets me a proper response from the server, while everything is ran through ssl without any problems. I <em>also</em> am able to use curl without checking the certificate: <code>curl --insecure https://example.com:3001/some/thing</code> works fine.</p>
  
  <p>At the same time secure <code>curl</code> call fails: <code>curl https://example.com:3001/some/thing</code> with the error:</p>
  
  <pre><code>curl: (60) SSL certificate problem: unable to get local issuer certificate
  More details here: https://curl.haxx.se/docs/sslcerts.html
  </code></pre>
  
  <p>Just to make sure both are using the same certificates, I actually used this tool: <a href="https://curl.haxx.se/docs/mk-ca-bundle.html" rel="nofollow noreferrer">https://curl.haxx.se/docs/mk-ca-bundle.html</a> to create a <code>ca-bundle.crt</code> from the most recent firefox certificates and passed it to curl with <code>--cacert ca-bundle.crt</code>. No luck - the same error. (I also tried following other curl tutorial on getting the local installation of firefox's certs, also no luck).</p>
  
  <h1>Question</h1>
  
  <p><strong>What is going on?</strong> Why is curl's output different from firefox's even if I seem to use the same certificates? How can I debug this?</p>
  
  <h3>Side note</h3>
  
  <p>The real reason I am concerned about it is that with a normal (local) access to the server, I observed the same behaviour: I could connect to the server through chrome on https, but my react native app could not. I suspect the app to use <code>libcurl</code> under the hood or something similar and I believe debugging this problem could help me understand what's the problem with the app.</p>