title: cURL not working (Error #77) for SSL connections on CentOS for non-root users
body: <p>Just recently my server has stopped working for curl requests to https:// addresses for my web server.  Having dug around a little it appears that it's a problem with the user the webserver is running.</p>
  
  <p>If I SSH onto the server as root &amp; call</p>
  
  <pre><code>curl -I -v https://google.com
  </code></pre>
  
  <p>... I get the following response...</p>
  
  <pre><code>* About to connect() to google.com port 443 (#0)
  *   Trying 173.194.67.113... connected
  * Connected to google.com (173.194.67.113) port 443 (#0)
  * Initializing NSS with certpath: sql:/etc/pki/nssdb
  *   CAfile: /etc/pki/tls/certs/ca-bundle.crt
    CApath: none
  * SSL connection using SSL_RSA_WITH_RC4_128_SHA
  * Server certificate:
  *       subject: CN=*.google.com,O=Google Inc,L=Mountain View,ST=California,C=US
  *       start date: May 22 15:50:20 2013 GMT
  *       expire date: Oct 31 23:59:59 2013 GMT
  *       common name: *.google.com
  *       issuer: CN=Google Internet Authority,O=Google Inc,C=US
  &gt; HEAD / HTTP/1.1
  &gt; User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.14.0.0 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
  &gt; Host: google.com
  &gt; Accept: */*
  </code></pre>
  
  <p>However, if I log in as any of the cPanel accounts (also used when running via the web server) I get the following...</p>
  
  <pre><code>* About to connect() to google.com port 443 (#0)
  *   Trying 173.194.67.101... connected
  * Connected to google.com (173.194.67.101) port 443 (#0)
  * Initializing NSS with certpath: none
  * NSS error -5978
  * Closing connection #0
  * Problem with the SSL CA cert (path? access rights?)
  curl: (77) Problem with the SSL CA cert (path? access rights?)
  </code></pre>
  
  <p>I've not been able to find a definitive answer to the problem, &amp; my hosting company are refusing to help as it's "Out of support" even though it was working fine last week!</p>
  
  <p>I did find mention on <a href="http://curl.haxx.se/docs/sslcerts.html">http://curl.haxx.se/docs/sslcerts.html</a> that</p>
  
  <blockquote>
    <p>"If libcurl was built with NSS support, then depending on the OS distribution,
    it is probably required to take some additional steps to use the system-wide CA
    cert db. RedHat ships with an additional module, libnsspem.so, which enables
    NSS to read the OpenSSL PEM CA bundle. This library is missing in OpenSuSE, and
    without it, NSS can only work with its own internal formats. NSS also has a new
    database format: <a href="https://wiki.mozilla.org/NSS_Shared_DB">https://wiki.mozilla.org/NSS_Shared_DB</a>"</p>
  </blockquote>
  
  <p>... but I can find no information on how I get this working system-wide on my CentOS server.</p>
  
  <h2>Info</h2>
  
  <pre><code>curl 7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.14.0.0 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
  Protocols: tftp ftp telnet dict ldap ldaps http file https ftps scp sftp 
  Features: GSS-Negotiate IDN IPv6 Largefile NTLM SSL libz 
  </code></pre>
  
  <p>Can anyone shed some light on why this might have suddenly changed, or better still how to fix it?</p>
  
  <p>Thanks</p>