Using Ubuntu 16.04, curl
version 7.47.0
I'm trying to debug an SSL certificate issue, and seeing odd behavior when using curl
. When I just run:
ubuntu@ip-172-30-0-81:~$ curl https://myapp.com/hello
curl: (51) SSL: certificate subject name (cloud.mynameserver.com) does not match target host name 'myapp.com'
However when I attach the -v
flag:
ubuntu@ip-172-30-0-81:~$ curl -v https://myapp.com/hello
* Trying {IP REDACTED}...
* Connected to myapp.com ({IP REDACTED}) port 443 (#0)
* found 173 certificates in /etc/ssl/certs/ca-certificates.crt
* found 692 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_RSA_AES_256_GCM_SHA384
* server certificate verification OK
* server certificate status verification SKIPPED
* common name: myapp.com (matched)
* server certificate expiration date OK
* server certificate activation date OK
* certificate public key: RSA
* certificate version: #3
* subject: CN=myapp.com
* start date: Sat, 31 Dec 2016 22:57:00 GMT
* expire date: Fri, 31 Mar 2017 22:57:00 GMT
* issuer: C=US,O=Let's Encrypt,CN=Let's Encrypt Authority X3
* compression: NULL
* ALPN, server accepted to use http/1.1
> GET /hello HTTP/1.1
> Host: myapp.com
> User-Agent: curl/7.47.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: nginx/1.10.0 (Ubuntu)
< Date: Sat, 21 Jan 2017 00:25:15 GMT
< Content-Type: application/json
< Transfer-Encoding: chunked
< Connection: keep-alive
< Strict-Transport-Security: max-age=63072000; includeSubdomains
< X-Frame-Options: DENY
< X-Content-Type-Options: nosniff
<
* Connection #0 to host myapp.com left intact
{"message": "Hello World"}
Note the very end, {"message": "Hello World"}
, is the expected response.
Why does curl
behave differently with respect to its trust of SSL certificate details, when running in verbose mode? This is not specified in the man
page, so far as I can tell.
It appears that you have two different
A
(orAAAA
for IPv6) records with that same hostname. When there are multiple records for a hostname, this causes each lookup for that hostname to return a different IP address round-robin style.When you alternate requests with and without verbose mode, the IP address is alternating as well, leading to the non-verbose requests hitting the wrong IP address while the verbose requests hit the correct IP address. This is why the correct certificate appears in the verbose address according to the
line, while a different certificate is given in the error for the non-verbose address.
The correct fix for this is to remove the incorrect
A
record so only the addresses of webservers configured to serve your content appear.