title: cURL unable to use curl-ca-bundle.crt when accessing SSL
body: <p>I'm on Windows attempting to use cURL using SSL, but running into certificate issues that I absolutely cannot figure out.</p>
  
  <p>For example, here is an example of what I'm trying to run.</p>
  
  <pre><code>$ curl "https://google.com" --ntlm -v --negotiate -u USERNAME:PASSWORD --proxy "PROXY" --cert "c:\temp\curl-ca-bundle.crt"
  * Adding handle: conn: 0x147ce88
  * Adding handle: send: 0
  * Adding handle: recv: 0
  * Curl_addHandleToPipeline: length: 1
  * - Conn 0 (0x147ce88) send_pipe: 1, recv_pipe: 0
  * About to connect() to proxy PROXY port 8080 (#0)
  *   Trying 192.168.134.80...
  * Connected to PROXY (PROXY_IP) port 8080 (#0)
  * Establish HTTP proxy tunnel to google.com:443
  &gt; CONNECT google.com:443 HTTP/1.1
  &gt; Host: google.com:443
  &gt; User-Agent: curl/7.30.0
  &gt; Proxy-Connection: Keep-Alive
  &gt;
  &lt; HTTP/1.1 200 Connection established
  &lt;
  * Proxy replied OK to CONNECT request
  * unable to use client certificate (no key found or wrong pass phrase?)
  * Closing connection 0
  curl: (58) unable to use client certificate (no key found or wrong pass phrase?)
  </code></pre>
  
  <p>Attempting to use <code>--cacert</code> instead of <code>--cert</code> yields the following message -</p>
  
  <pre><code>* Adding handle: conn: 0x130cdf8
  * Adding handle: send: 0
  * Adding handle: recv: 0
  * Curl_addHandleToPipeline: length: 1
  * - Conn 0 (0x130cdf8) send_pipe: 1, recv_pipe: 0
  * About to connect() to proxy PROXY port 8080 (#0)
  *   Trying 192.168.135.80...
  * Connected to PROXY (PROXY_IP) port 8080 (#0)
  * Establish HTTP proxy tunnel to google.com:443
  &gt; CONNECT google.com:443 HTTP/1.1
  &gt; Host: google.com:443
  &gt; User-Agent: curl/7.30.0
  &gt; Proxy-Connection: Keep-Alive
  &gt;
  &lt; HTTP/1.1 200 Connection established
  &lt;
  * Proxy replied OK to CONNECT request
  * successfully set certificate verify locations:
  *   CAfile: c:\temp\curl-ca-bundle.crt
    CApath: none
  * SSLv3, TLS handshake, Client hello (1):
  * SSLv3, TLS handshake, Server hello (2):
  * SSLv3, TLS handshake, CERT (11):
  * SSLv3, TLS alert, Server hello (2):
  * SSL certificate problem: unable to get local issuer certificate
  * Closing connection 0
  curl: (60) SSL certificate problem: unable to get local issuer certificate
  More details here: http://curl.haxx.se/docs/sslcerts.html
  
  curl performs SSL certificate verification by default, using a "bundle"
   of Certificate Authority (CA) public keys (CA certs). If the default
   bundle file isn't adequate, you can specify an alternate file
   using the --cacert option.
  If this HTTPS server uses a certificate signed by a CA represented in
   the bundle, the certificate verification probably failed due to a
   problem with the certificate (it might be expired, or the name might
   not match the domain name in the URL).
  If you'd like to turn off curl's verification of the certificate, use the
  -k (or --insecure) option.
  </code></pre>
  
  <p>The <code>curl-ca-bundle.crt</code> I have is from <a href="https://raw.githubusercontent.com/bagder/ca-bundle/master/ca-bundle.crt" rel="nofollow">here</a>, which was update a few minutes ago. I ensured the file is not blocked by Windows.</p>
  
  <p>For what it's worth, I'm behind a corporate proxy and firewall. I have read everything I could find on this issue and don't know what to do next. I do realize I can ignore SSL, but would like to avoid this at all costs.</p>