cURL SSL connect error 35 with NSS error -5961

Question

I have a remote Windows 7 server that is accessible only via HTTPS on port 768. The server is using a signed certificate from a CA listed in the local CentOS server. Whenever I try to access the remote server via cURL using the following command, it errors out as follows: ``` [usr@serv certs]# curl -3 -v https://1.1.1.1:768/user/login * About to connect() to 1.1.1.1 port 768 (#0) * Trying 1.1.1.1... connected * Connected to 1.1.1.1 (1.1.1.1) port 768 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * NSS error -5961 * Closing connection #0 * SSL connect error curl: (35) SSL connect error ``` (Note that the IP address has been hidden for security reasons). I am running the following version of cURL: ``` curl 7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.14.0.0 zlib/1.2.3 libidn/1.18 libssh2/1.4.2 ``` It's worth noting that this is working on two other remote servers which are both running Windows XP rather than wi…

Accepted Answer

`curl` with NSS read the Root CA certificates by default from `"/etc/pki/tls/certs/ca-bundle.crt"` in the PEM format. ``` * Initializing NSS with certpath: sql:/etc/pki/nssdb * CAfile: /etc/pki/tls/certs/ca-bundle.crt ``` You can specify another (your) CA certificate (or bundle on the NSS Shared DB) by curl's option `--cacert` with the PEM file containing the CA certificate(s). If you don't specify the certificate manually with `--cacert` option, NSS tries to select the right one from the NSS database (located at `/etc/pki/nssdb`) automatically. You can specify it's nickname by curl's option `--cert`, this should be sufficient if the key is embedded in the cert, if not you can specify the PEM file with the certificate key using the `--key`. If the key is protected by a pass-phrase, you can give it by curl's option `--pass` so you can import your certificate to the NSS shared DB using the nss-tools (`yum install nss-tools`) Adding a certificate (common command line) ``` certutil -d sql:/etc/pki/nssdb -A -t -n -i ``` About TRUSTARGS Specify the trust attributes to modify in an existing certificate or to apply to a certificate when creating it or adding it to a database. There are three available trust categories for each certificate, expressed in this order: " SSL , email , object signing ". In each category position use zero or more of the following attribute codes: - p prohibited (explicitly distrusted) - P Trusted peer - c Valid CA - T Trusted CA to issue client certificates (implies c) - C Trusted CA to issue server certificates (SSL only) (implies c) - u Certificate can be used for authentication or signing - w Send warning (use with other attributes to include a warning when the certificate is used in that context) The attribute codes for the categories are separated by commas, and the entire set of attributes enclosed by quotation marks. For example: -t "TCu,Cu,Tuw" Trusting a root CA certificate for issuing SSL server certificates ``` certutil -d sql:/etc/pki/nssdb -A -t "C,," -n -i ``` Importing an intermediate CA certificate ``` certutil -d sql:/etc/pki/nssdb -A -t ",," -n -i ``` Trusting a self-signed server certificate ``` certutil -d sql:/etc/pki/nssdb -A -t "P,," -n -i ``` Adding a personal certificate and private key for SSL client authentication ``` pk12util -d sql:/etc/pki/nssdb -i PKCS12_file_with_your_cert.p12 ``` Listing all the certificates stored into NSS DB ``` certutil -d sql:/etc/pki/nssdb -L ``` Listing details of a certificate ``` certutil -d sql:/etc/pki/nssdb -L -n ``` Deleting a certificate ``` certutil -d sql:/etc/pki/nssdb -D -n ``` Hope this helps.

cURL SSL connect error 35 with NSS error -5961

Solution

Problem