title: Why won't curl recognise a self-signed SSL certificate?
body: <p>I copied the PEM file into /usr/local/share/ca-certificates/ and ran update-ca-certificates, and I verified that the resulting certificate is now included in /etc/ssl/certs/ca-certificates.crt which is the file printed by curl-config --ca.  I also verified that the certificate printed by openssl s_client -connect example.com:443 was identical to my PEM file.  And yet I continue to get the "error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed" message.  This happens even if I use curl's --cacert option as described at <a href="http://curl.haxx.se/docs/sslcerts.html" rel="noreferrer">http://curl.haxx.se/docs/sslcerts.html</a> to tell it what certificate to use.</p>
  
  <p>It works if I disable certificate verification altogether with curl -k, but I don't want to do that because I'm trying to write a test harness that's supposed to test the SSL properly.</p>
  
  <p>It works fine if I access the same URL in lynx, which normally complains if there are any SSL errors.  But I can't just use Lynx for this test harness, unless I can find some way of making Tornado's AsyncHTTPClient use Lynx instead of libcurl.  And it doesn't seem to make any sense that installing the self-signed certificate satisfies Lynx but not curl.</p>
  
  <p>I'm using Ubuntu 12.04 LTS in a Vagrant-powered VirtualBox; it has curl 7.22.0.  The SSL terminating proxy is nginx/1.3.13 running on the same machine, and the domain name is pointed to 127.0.0.1 by an entry in /etc/hosts.</p>
  
  <p>Any clues on what might be the problem?  Thanks.</p>