title: SSL CA Certificates - LibCurl C Language (Linux)
body: <p>Im working with a WebService and I still cannot authenticate peer certificates.
  Im using libCurl to C language, this is the output:</p>
  
  <blockquote>
    <p>Cannot Perform Post, Err: Peer certificate cannot be authenticated with given CA certificates</p>
  </blockquote>
  
  <p>So I've tried to test connection through openssl command:</p>
  
  <p><code>openssl s_client -connect homnfce.sefaz.am.gov.br:443 -cert cert.pem -key nfcek.pem</code></p>
  
  <p>Then :
  <code>Verify return code: 20 (unable to get local issuer certificate)</code></p>
  
  <p>Going further I looked around to server certificates, and noticed that they have a cert chain.
  So I've downloaded them and added using keytool:</p>
  
  <pre><code>keytool -import -trustcacerts -file cert1.cer -alias mykey
  keytool -import -trustcacerts -file cert2.cer -alias mykey2
  keytool -import -trustcacerts -file cert3.cer -alias mykey3
  </code></pre>
  
  <p>Even with these changes, I still can't authenticate peer certificates.</p>
  
  <p>I think it can indicate an error while setting CURLOPTs, heres a extract of code:</p>
  
  <pre><code> if (curl_easy_setopt(curl, CURLOPT_POST, 1) != CURLE_OK) {
      if ( DEBUG_DETAILS ) vTrace("curl_easy_setopt(curl, CURLOPT_POST, 1) failed");
      return -1;
    }
    if (curl_easy_setopt(curl, CURLOPT_URL, "https://homnfce.sefaz.am.gov.br/nfce-services-nac/services/NfeStatusServico2?wsdl") != CURLE_OK) {
      if ( DEBUG_DETAILS ) vTrace("curl_easy_setopt(curl, CURLOPT_URL) failed");
      return -1;
    }
    if (curl_easy_setopt(curl, CURLOPT_PORT, 443) != CURLE_OK) {
      if ( DEBUG_DETAILS ) vTrace("curl_easy_setopt(curl, CURLOPT_PORT, 443) failed");
      return -1;
    }
    if (curl_easy_setopt(curl, CURLOPT_SSLCERT, "cert.pem") != CURLE_OK) {
      if ( DEBUG_DETAILS ) vTrace("curl_easy_setopt(curl, CURLOPT_SSLCERT) failed");
      return -1;
    }
    if (curl_easy_setopt(curl, CURLOPT_SSLKEY, "nfcek.pem") != CURLE_OK) {
      if ( DEBUG_DETAILS ) vTrace("curl_easy_setopt(curl, CURLOPT_SSLKEY) failed");
      return -1;
    }
    sprintf(szCertPath, "%s","/home/CAcerts/");
    if (curl_easy_setopt(curl, CURLOPT_CAPATH, szCertPath) != CURLE_OK) {
      if ( DEBUG_DETAILS ) vTrace("curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER) failed");
      return -1;
    }
    if (curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, iLen) != CURLE_OK) {
      if ( DEBUG_DETAILS ) vTrace("curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE) failed");
      return -1;
    }
    if (curl_easy_setopt(curl, CURLOPT_SSLCERTPASSWD, szMyPw) != CURLE_OK ) {
      if ( DEBUG_DETAILS ) vTrace("curl_easy_setopt(curl, CURLOPT_TIMEOUT) failed");
      return -1;
    }
    if (curl_easy_setopt(curl, CURLOPT_READDATA, pfChk) != CURLE_OK ) {
      if ( DEBUG_DETAILS ) vTrace("curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE) failed");
      return -1;
    }
    if (curl_easy_setopt(curl, CURLOPT_WRITEDATA, pfAnswer) != CURLE_OK ) {
      if ( DEBUG_DETAILS ) vTrace("curl_easy_setopt(curl, CURLOPT_WRITEDATA) failed");
      return -1;
    }
    if (curl_easy_setopt(curl, CURLOPT_TIMEOUT, iOnlineServerTimeout) != CURLE_OK ) {
      if ( DEBUG_DETAILS ) vTrace("curl_easy_setopt(curl, CURLOPT_TIMEOUT) failed");
      return -1;
    }
    if (curl_easy_setopt(curl, CURLOPT_NOSIGNAL, 1) != CURLE_OK) {
      if ( DEBUG_DETAILS ) vTrace("curl_easy_setopt(curl, CURLOPT_NOSIGNAL, 1) failed");
      return __LINE__;
    }
  
    if ( (res = curl_easy_perform(curl)) != CURLE_OK ){
      if ( DEBUG_DETAILS ) vTraceStr("iNFCE_CurlReq(): Cannot Perform Post, Err: %s\n", (char *)curl_easy_strerror(res));
      return -1;
    }
  </code></pre>
  
  <p>Something important is the fact that I <strong>can't</strong> use insecure mode option ingnore peer authentication (CURLOPT_SSL_VERIFYPEER = 0 ).</p>
  
  <p>Any ideas? What can be wrong?</p>
  
  <p>Thanks in advance</p>