title: SSL certificates and cURL: certificate bundle or untrusted certificate?
body: <p>We have a webapp which fetches XML files to validate against an XML schema.  The app runs on an Ubuntu server which was set up some years ago.  </p>
  
  <p>There is an issue where cURL-ing a given domain fails because it was the certificate cannot be verified.  I’m hearing conflicting things about if the problem is on our side, or if it is an issue that we should contact the client to resolve.</p>
  
  <p>For example, using cURL gives:</p>
  
  <pre><code>(pyenv)vagrant@precise64:~$ curl "https://example.com"
  curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
  error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
  More details here: http://curl.haxx.se/docs/sslcerts.html
  
  curl performs SSL certificate verification by default, using a "bundle"
   of Certificate Authority (CA) public keys (CA certs). If the default
   bundle file isn't adequate, you can specify an alternate file
   using the --cacert option.
  If this HTTPS server uses a certificate signed by a CA represented in
   the bundle, the certificate verification probably failed due to a
   problem with the certificate (it might be expired, or the name might
   not match the domain name in the URL).
  If you'd like to turn off curl's verification of the certificate, use
   the -k (or --insecure) option.
  </code></pre>
  
  <p>I have tried to research what could be wrong <a href="https://www.sslshopper.com/ssl-checker.html" rel="nofollow">This SSL checker</a> says that the certificate authority (CA) may not be trusted in some browsers:</p>
  
  <blockquote>
    <p>The certificate is not trusted in all web browsers. You may need to
    install an Intermediate/chain certificate to link it to a trusted root
    certificate.</p>
  </blockquote>
  
  <p>I then tried the URL in several browsers using browserstack with the predicted mixed results - the request works on some browsers, fails on others.</p>
  
  <p>Basically I’m not sure if we should...</p>
  
  <ol>
  <li>Find some way of updating the ‘certificate bundles’ on our
  server. If this is even best practice?</li>
  <li>Telling the people at example.com that the problem is at
  their end and they need to get a fully trusted certificate</li>
  </ol>
  
  <p>The discounted options:</p>
  
  <ol start="3">
  <li>Installing the certificate for example.com only &lt;- Discounted as this does not
  seem sustainable if other sites have the same issue</li>
  <li>Turning off SSL verification on the app &lt;- Discounted
  as this is insecure and not good practice - even for an XML schema
  validator</li>
  </ol>