Re: [Buildroot] libcurl ignores default buildroot CA bundle

[Dimi Tomov <dimi@tpm.dev>]

make libcurl-dirclean forced a rebuild with  wolfssl as the crypto 
backend, however --with-ca-path does not work. Error below:

checking default CA cert bundle/path... configure: error: --with-ca-path 
only works with OpenSSL, GnuTLS or mbedTLS

How to enable buildroot CA bundle for libcurl when using wolfssl?

Thanks,
Dimi


On 2022-06-05 11:32 AM, Dimi Tomov wrote:
> I think I found another issue:
> 
> $make libcurl-reconfigure does not change the cryptopgrahic provider 
> for curl.
> 
> I change the option using make menuconfig and I see it reflected in my
> buildroot config.
> 
> ps: about curl w/ openssl, my board had its date set to May instead of
> June and this was the issue.
> 
> Thanks,
> 
> Dimi
> 
> On 2022-06-05 11:16 AM, Dimi Tomov wrote:
>> I forgot to mention that I have updated the system clock using data &
>> hwclock -wu and the issue with libcurl and ca-certificates packages
>> persists.
>> 
>> On 2022-06-05 10:24 AM, Dimi Tomov wrote:
>>> Hell Martin and Baruch,
>>> 
>>> Issue persist after building my buildroot image with libcurl and
>>> openssl as a cryptographic provider, ca-certificates package 
>>> installed
>>> properly and in default location. Error message only changed a bit:
>>> 
>>> # curl https://google.com
>>> curl: (60) SSL certificate problem: certificate is not yet valid
>>> More details here: https://curl.se/docs/sslcerts.html
>>> 
>>> curl failed to verify the legitimacy of the server and therefore 
>>> could not
>>> establish a secure connection to it. To learn more about this 
>>> situation and
>>> how to fix it, please visit the web page mentioned above.
>>> 
>>> ^the above page mentions that a CA bundle is missing.
>>> 
>>> However, /etc/ssl/certs is deployed properly by the buildroot make 
>>> and
>>> sdcard image.
>>> 
>>> Any ideas?
>>> 
>>> Thanks,
>>> 
>>> Dimi
>>> 
>>> --
>>> Founder of TPM.dev
>>> 
>>> On 2022-06-04 09:16 PM, Dimi Tomov wrote:
>>>> Hello Baruch,
>>>> 
>>>> I may have found an issue with the libcurl package.
>>>> 
>>>> The libcurl.mk file lacks CA path when built with wolfssl instead of 
>>>> openssl.
>>>> 
>>>> ifeq ($(BR2_PACKAGE_LIBCURL_WOLFSSL),y)
>>>> LIBCURL_CONF_OPTS += --with-wolfssl=$(STAGING_DIR)/usr
>>>> LIBCURL_DEPENDENCIES += wolfssl
>>>> else
>>>> LIBCURL_CONF_OPTS += --without-wolfssl
>>>> endif
>>>> 
>>>> I tried adding LIBCURL_CONF_OPTS += --with-ca-path=/etc/ssl/certs in
>>>> the above if case and rebuild, but this did not solve the issue. 
>>>> Could
>>>> you please take a look?
>>>> 
>>>> Thanks,
>>>> 
>>>> Dimi
>>>> 
>>>> On 2022-06-04 07:43 PM, Dimi Tomov wrote:
>>>>> Hello Buildroot community,
>>>>> 
>>>>> I have a STM32MP1 target and my buildroot image has both the curl 
>>>>> and
>>>>> ca-certificates package installed. However, curl fails to 
>>>>> authenticate
>>>>> any https requests:
>>>>> 
>>>>> 
>>>>> # curl https://google.com
>>>>> 
>>>>> curl: (77)  CA signer not available for verification
>>>>> 
>>>>> 
>>>>> Do I need to do some extra buildroot configuration for libcurl to 
>>>>> use
>>>>> the CA bundle in /etc/ssl/certs?
>>>>> 
>>>>> Thanks,
>>>>> 
>>>>> Dimi Tomov
>>>>> --
>>>>> Founder of TPM.dev
>>>>> _______________________________________________
>>>>> buildroot mailing list
>>>>> buildroot@buildroot.org
>>>>> https://lists.buildroot.org/mailman/listinfo/buildroot
>>> _______________________________________________
>>> buildroot mailing list
>>> buildroot@buildroot.org
>>> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
Founder of TPM.dev
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot