Re: [Buildroot] libcurl ignores default buildroot CA bundle

[Dimi Tomov <dimi@tpm.dev>]

I forgot to mention that I have updated the system clock using data & 
hwclock -wu and the issue with libcurl and ca-certificates packages 
persists.

On 2022-06-05 10:24 AM, Dimi Tomov wrote:
> Hell Martin and Baruch,
> 
> Issue persist after building my buildroot image with libcurl and
> openssl as a cryptographic provider, ca-certificates package installed
> properly and in default location. Error message only changed a bit:
> 
> # curl https://google.com
> curl: (60) SSL certificate problem: certificate is not yet valid
> More details here: https://curl.se/docs/sslcerts.html
> 
> curl failed to verify the legitimacy of the server and therefore could 
> not
> establish a secure connection to it. To learn more about this situation 
> and
> how to fix it, please visit the web page mentioned above.
> 
> ^the above page mentions that a CA bundle is missing.
> 
> However, /etc/ssl/certs is deployed properly by the buildroot make and
> sdcard image.
> 
> Any ideas?
> 
> Thanks,
> 
> Dimi
> 
> --
> Founder of TPM.dev
> 
> On 2022-06-04 09:16 PM, Dimi Tomov wrote:
>> Hello Baruch,
>> 
>> I may have found an issue with the libcurl package.
>> 
>> The libcurl.mk file lacks CA path when built with wolfssl instead of 
>> openssl.
>> 
>> ifeq ($(BR2_PACKAGE_LIBCURL_WOLFSSL),y)
>> LIBCURL_CONF_OPTS += --with-wolfssl=$(STAGING_DIR)/usr
>> LIBCURL_DEPENDENCIES += wolfssl
>> else
>> LIBCURL_CONF_OPTS += --without-wolfssl
>> endif
>> 
>> I tried adding LIBCURL_CONF_OPTS += --with-ca-path=/etc/ssl/certs in
>> the above if case and rebuild, but this did not solve the issue. Could
>> you please take a look?
>> 
>> Thanks,
>> 
>> Dimi
>> 
>> On 2022-06-04 07:43 PM, Dimi Tomov wrote:
>>> Hello Buildroot community,
>>> 
>>> I have a STM32MP1 target and my buildroot image has both the curl and
>>> ca-certificates package installed. However, curl fails to 
>>> authenticate
>>> any https requests:
>>> 
>>> 
>>> # curl https://google.com
>>> 
>>> curl: (77)  CA signer not available for verification
>>> 
>>> 
>>> Do I need to do some extra buildroot configuration for libcurl to use
>>> the CA bundle in /etc/ssl/certs?
>>> 
>>> Thanks,
>>> 
>>> Dimi Tomov
>>> --
>>> Founder of TPM.dev
>>> _______________________________________________
>>> buildroot mailing list
>>> buildroot@buildroot.org
>>> https://lists.buildroot.org/mailman/listinfo/buildroot
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
Founder of TPM.dev
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot