Re: [Buildroot] libcurl ignores default buildroot CA bundle

[Dimi Tomov <dimi@tpm.dev>]

Hi Baruch,

Please review the patch that fixes this - 
https://lists.buildroot.org/pipermail/buildroot/2022-June/644127.html

Thanks,
Dimi

On 2022-06-05 01:04 PM, Dimi Tomov wrote:
> make libcurl-dirclean forced a rebuild with  wolfssl as the crypto
> backend, however --with-ca-path does not work. Error below:
> 
> checking default CA cert bundle/path... configure: error:
> --with-ca-path only works with OpenSSL, GnuTLS or mbedTLS
> 
> How to enable buildroot CA bundle for libcurl when using wolfssl?
> 
> Thanks,
> Dimi
> 
> 
> On 2022-06-05 11:32 AM, Dimi Tomov wrote:
>> I think I found another issue:
>> 
>> $make libcurl-reconfigure does not change the cryptopgrahic provider 
>> for curl.
>> 
>> I change the option using make menuconfig and I see it reflected in my
>> buildroot config.
>> 
>> ps: about curl w/ openssl, my board had its date set to May instead of
>> June and this was the issue.
>> 
>> Thanks,
>> 
>> Dimi
>> 
>> On 2022-06-05 11:16 AM, Dimi Tomov wrote:
>>> I forgot to mention that I have updated the system clock using data &
>>> hwclock -wu and the issue with libcurl and ca-certificates packages
>>> persists.
>>> 
>>> On 2022-06-05 10:24 AM, Dimi Tomov wrote:
>>>> Hell Martin and Baruch,
>>>> 
>>>> Issue persist after building my buildroot image with libcurl and
>>>> openssl as a cryptographic provider, ca-certificates package 
>>>> installed
>>>> properly and in default location. Error message only changed a bit:
>>>> 
>>>> # curl https://google.com
>>>> curl: (60) SSL certificate problem: certificate is not yet valid
>>>> More details here: https://curl.se/docs/sslcerts.html
>>>> 
>>>> curl failed to verify the legitimacy of the server and therefore 
>>>> could not
>>>> establish a secure connection to it. To learn more about this 
>>>> situation and
>>>> how to fix it, please visit the web page mentioned above.
>>>> 
>>>> ^the above page mentions that a CA bundle is missing.
>>>> 
>>>> However, /etc/ssl/certs is deployed properly by the buildroot make 
>>>> and
>>>> sdcard image.
>>>> 
>>>> Any ideas?
>>>> 
>>>> Thanks,
>>>> 
>>>> Dimi
>>>> 
>>>> --
>>>> Founder of TPM.dev
>>>> 
>>>> On 2022-06-04 09:16 PM, Dimi Tomov wrote:
>>>>> Hello Baruch,
>>>>> 
>>>>> I may have found an issue with the libcurl package.
>>>>> 
>>>>> The libcurl.mk file lacks CA path when built with wolfssl instead 
>>>>> of openssl.
>>>>> 
>>>>> ifeq ($(BR2_PACKAGE_LIBCURL_WOLFSSL),y)
>>>>> LIBCURL_CONF_OPTS += --with-wolfssl=$(STAGING_DIR)/usr
>>>>> LIBCURL_DEPENDENCIES += wolfssl
>>>>> else
>>>>> LIBCURL_CONF_OPTS += --without-wolfssl
>>>>> endif
>>>>> 
>>>>> I tried adding LIBCURL_CONF_OPTS += --with-ca-path=/etc/ssl/certs 
>>>>> in
>>>>> the above if case and rebuild, but this did not solve the issue. 
>>>>> Could
>>>>> you please take a look?
>>>>> 
>>>>> Thanks,
>>>>> 
>>>>> Dimi
>>>>> 
>>>>> On 2022-06-04 07:43 PM, Dimi Tomov wrote:
>>>>>> Hello Buildroot community,
>>>>>> 
>>>>>> I have a STM32MP1 target and my buildroot image has both the curl 
>>>>>> and
>>>>>> ca-certificates package installed. However, curl fails to 
>>>>>> authenticate
>>>>>> any https requests:
>>>>>> 
>>>>>> 
>>>>>> # curl https://google.com
>>>>>> 
>>>>>> curl: (77)  CA signer not available for verification
>>>>>> 
>>>>>> 
>>>>>> Do I need to do some extra buildroot configuration for libcurl to 
>>>>>> use
>>>>>> the CA bundle in /etc/ssl/certs?
>>>>>> 
>>>>>> Thanks,
>>>>>> 
>>>>>> Dimi Tomov
>>>>>> --
>>>>>> Founder of TPM.dev
>>>>>> _______________________________________________
>>>>>> buildroot mailing list
>>>>>> buildroot@buildroot.org
>>>>>> https://lists.buildroot.org/mailman/listinfo/buildroot
>>>> _______________________________________________
>>>> buildroot mailing list
>>>> buildroot@buildroot.org
>>>> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
Founder of TPM.dev
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot