title: Curl Command Failing - SSL Certificate (Exit Code 60) Inside Docker Container Running on Windows Machine
body: <p>There is a shell script that builds a Docker Image (calling a Dockerfile). In the Dockerfile there are several CURL commands like this:
  The Docker Container is using base OS as : <code>Debian GNU/Linux 10</code></p>
  <pre><code>RUN curl -s -L \
      https://repo1.maven.org/ ...
  
  RUN curl -s -L \
      https://github.com/CodeNarc/ ... \
      -o codenarc.jar
  
  RUN curl -s -L \
      https://repo1.maven.org/ ...
  
  RUN curl -s -L \
      https://repo1.maven.org/ ...
  </code></pre>
  <p>The above Dockerfile is <strong>running fine</strong> when the host machine is either <strong>Mac or Linux</strong> based.</p>
  <p>But when we are trying to run this on Windows host machine the <strong>2nd curl command i.e. to “github.com” is failing with SSL Certificate issue (Exit Code 60).</strong></p>
  <p>We are not doing anything related to PHP, so any such solution (related to php.ini file) is irrelevant for me.</p>
  <p><strong>Now I have tried almost everything available to solve this issue but nothing seems to be working:</strong></p>
  <ol>
  <li>Downloading <code>cacert.pem</code> file from given location and putting into “<code>/etc/ssl/certs</code>”, but it didn’t work</li>
  <li>I tried using <code>update-ca-certificate</code>, but it didn’t work</li>
  <li>Used <code>--cacert &lt;cacert.pem file location on docker container&gt;</code>, but this also didn’t work</li>
  </ol>
  <p>The only solution working is with <code>-k</code> flag in curl command, but that is insecure and we don't want to use that.
  I cant find any other solution for this, if anyone can help, it will be much appreciated.</p>
  <p>Thanks</p>
  <hr />
  <p>Adding on what I tried running <code>openssl s_client -showcerts -connect github.com:443</code> on Windows Host Machine:</p>
  <pre><code>---
  No client certificate CA names sent
  Peer signing digest: SHA256
  Peer signature type: RSA
  Server Temp Key: ECDH, P-256, 256 bits
  ---
  SSL handshake has read 3851 bytes and written 438 bytes
  Verification error: unable to get local issuer certificate
  ---
  New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
  Server public key is 2048 bit
  Secure Renegotiation IS supported
  Compression: NONE
  Expansion: NONE
  No ALPN negotiated
  SSL-Session:
      Protocol  : TLSv1.2
      Cipher    : ECDHE-RSA-AES256-GCM-SHA384
      Session-ID: 441C92CFBEA27773315E4A9476C3A5173F0A2AB0AADDE708568DD8752EAA8A5A
      Session-ID-ctx:
      Master-Key: DF6DB0BC64F84ADD5974694845136249AEBEFB2559009AAD2A5C27A6FC981915AB50A765914CAA8AFCAC904B9998FF54
      PSK identity: None
      PSK identity hint: None
      SRP username: None
      Start Time: 1614064531
      Timeout   : 7200 (sec)
      Verify return code: 20 (unable to get local issuer certificate)
      Extended master secret: no
  ---
  depth=2 C = US, O = &quot;Blue Coat Systems, Inc.&quot;, CN = Cloud Services CA - G2
  verify error:num=20:unable to get local issuer certificate
  verify return:1
  depth=1 C = US, O = Cloud Services, OU = Operations, CN = SSL-SG1-GINCH7
  verify return:1
  depth=0 C = US, ST = California, L = San Francisco, O = &quot;GitHub, Inc.&quot;, CN = github.com
  verify return:1
  </code></pre>
  <p>Then I ran the same command from inside the Docker:</p>
  <pre><code>---
  No client certificate CA names sent
  Peer signing digest: SHA256
  Peer signature type: RSA
  Server Temp Key: ECDH, P-256, 256 bits
  ---
  SSL handshake has read 3851 bytes and written 438 bytes
  Verification error: unable to get local issuer certificate
  ---
  New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
  Server public key is 2048 bit
  Secure Renegotiation IS supported
  Compression: NONE
  Expansion: NONE
  No ALPN negotiated
  SSL-Session:
      Protocol  : TLSv1.2
      Cipher    : ECDHE-RSA-AES256-GCM-SHA384
      Session-ID: 441C92CFBEA27773315E4A9476C3A5173F0A2AB0AADDE708568DD8752EAA8A5A
      Session-ID-ctx:
      Master-Key: DF6DB0BC64F84ADD5974694845136249AEBEFB2559009AAD2A5C27A6FC981915AB50A765914CAA8AFCAC904B9998FF54
      PSK identity: None
      PSK identity hint: None
      SRP username: None
      Start Time: 1614064531
      Timeout   : 7200 (sec)
      Verify return code: 20 (unable to get local issuer certificate)
      Extended master secret: no
  ---
  depth=2 C = US, O = &quot;Blue Coat Systems, Inc.&quot;, CN = Cloud Services CA - G2
  verify error:num=20:unable to get local issuer certificate
  verify return:1
  depth=1 C = US, O = Cloud Services, OU = Operations, CN = SSL-SG1-GINCH7
  verify return:1
  depth=0 C = US, ST = California, L = San Francisco, O = &quot;GitHub, Inc.&quot;, CN = github.com
  verify return:1
  </code></pre>