title: curl SSL certificate error: verifcation failed
body: <p>Please help me understand why I cannot successfully curl this url via https:</p>
  
  <p>I am using Ubuntu 12.04.5 with curl 7.22.0, libcurl 7.22.0 and OpenSSL 1.0.1-4ubuntu5.25</p>
  
  <pre><code>$ curl -v https://www.onevanilla.com/
  * About to connect() to www.onevanilla.com port 443 (#0)
  *   Trying 199.83.128.4... connected
  * successfully set certificate verify locations:
  *   CAfile: none
    CApath: /etc/ssl/certs
  * SSLv3, TLS handshake, Client hello (1):
  * SSLv3, TLS handshake, Server hello (2):
  * SSLv3, TLS handshake, CERT (11):
  * SSLv3, TLS alert, Server hello (2):
  * SSL certificate problem, verify that the CA cert is OK. Details:
  error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
  * Closing connection #0
  curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
  error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
  </code></pre>
  
  <p>So I try to manually get the cert:</p>
  
  <pre><code>$ openssl s_client -connect www.onevanilla.com:443 &lt;/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' &gt; /tmp/www.onevanilla.com.pem
  </code></pre>
  
  <p>and then:</p>
  
  <pre><code>$ curl -v --cacert /tmp/www.onevanilla.com.pem https://www.onevanilla.com
  </code></pre>
  
  <p>but I get the same result:</p>
  
  <pre><code>* About to connect() to www.onevanilla.com port 443 (#0)
  *   Trying 199.83.128.4... connected
  * successfully set certificate verify locations:
  *   CAfile: /tmp/www.onevanilla.com.pem
    CApath: /etc/ssl/certs
  * SSLv3, TLS handshake, Client hello (1):
  * SSLv3, TLS handshake, Server hello (2):
  * SSLv3, TLS handshake, CERT (11):
  * SSLv3, TLS alert, Server hello (2):
  * SSL certificate problem, verify that the CA cert is OK. Details:
  error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
  * Closing connection #0
  curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
  error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
  </code></pre>
  
  <p>I can verify the certificate with openssl:</p>
  
  <pre><code>$ openssl s_client -host www.onevanilla.com -port 443 -CApath /etc/ssl/certs
  </code></pre>
  
  <p>and this returns <code>Verify return code: 0 (ok)</code></p>
  
  <p>I've also run <code>sudo update-ca-certificates --fresh</code> just to be sure, but no luck.</p>
  
  <p>So it seems to me like the cert is valid (not expired, hostname matches CN), but I can never get a successful response using curl (unless of course I use <code>-k</code> or <code>--insecure</code> options). Can someone please explain?</p>