Re: [Buildroot] libcurl ignores default buildroot CA bundle

[Dimi Tomov <dimi@tpm.dev>]

Hell Martin and Baruch,

Issue persist after building my buildroot image with libcurl and openssl 
as a cryptographic provider, ca-certificates package installed properly 
and in default location. Error message only changed a bit:

# curl https://google.com
curl: (60) SSL certificate problem: certificate is not yet valid
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could 
not
establish a secure connection to it. To learn more about this situation 
and
how to fix it, please visit the web page mentioned above.

^the above page mentions that a CA bundle is missing.

However, /etc/ssl/certs is deployed properly by the buildroot make and 
sdcard image.

Any ideas?

Thanks,

Dimi

-- 
Founder of TPM.dev

On 2022-06-04 09:16 PM, Dimi Tomov wrote:
> Hello Baruch,
> 
> I may have found an issue with the libcurl package.
> 
> The libcurl.mk file lacks CA path when built with wolfssl instead of 
> openssl.
> 
> ifeq ($(BR2_PACKAGE_LIBCURL_WOLFSSL),y)
> LIBCURL_CONF_OPTS += --with-wolfssl=$(STAGING_DIR)/usr
> LIBCURL_DEPENDENCIES += wolfssl
> else
> LIBCURL_CONF_OPTS += --without-wolfssl
> endif
> 
> I tried adding LIBCURL_CONF_OPTS += --with-ca-path=/etc/ssl/certs in
> the above if case and rebuild, but this did not solve the issue. Could
> you please take a look?
> 
> Thanks,
> 
> Dimi
> 
> On 2022-06-04 07:43 PM, Dimi Tomov wrote:
>> Hello Buildroot community,
>> 
>> I have a STM32MP1 target and my buildroot image has both the curl and
>> ca-certificates package installed. However, curl fails to authenticate
>> any https requests:
>> 
>> 
>> # curl https://google.com
>> 
>> curl: (77)  CA signer not available for verification
>> 
>> 
>> Do I need to do some extra buildroot configuration for libcurl to use
>> the CA bundle in /etc/ssl/certs?
>> 
>> Thanks,
>> 
>> Dimi Tomov
>> --
>> Founder of TPM.dev
>> _______________________________________________
>> buildroot mailing list
>> buildroot@buildroot.org
>> https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot