Using Ubuntu 16.04, curl version 7.47.0
I'm trying to debug an SSL certificate issue, and seeing odd behavior when using curl. When I just run:
ubuntu@ip-172-30-0-81:~$ curl https://myapp.com/hello
curl: (51) SSL: certificate subject name (cloud.mynameserver.com) does not match target host name 'myapp.com'
However when I attach the -v flag:
ubuntu@ip-172-30-0-81:~$ curl -v https://myapp.com/hello
* Trying {IP REDACTED}...
* Connected to myapp.com ({IP REDACTED}) port 443 (#0)
* found 173 certificates in /etc/ssl/certs/ca-certificates.crt
* found 692 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_RSA_AES_256_GCM_SHA384
* server certificate verification OK
* server certificate status verification SKIPPED
* common name: myapp.com (matched)
* server certificate expiration date OK
* server certificate activation date OK
* certificate public key: RSA
* certificate version: #3
* subject: CN=myapp.com
* start date: Sat, 31 Dec 2016 22:57:00 GMT
* expire date: Fri, 31 Mar 2017 22:57:00 GMT
* issuer: C=US,O=Let's Encrypt,CN=Let's Encrypt Authority X3
* compression: NULL
* ALPN, server accepted to use http/1.1
> GET /hello HTTP/1.1
> Host: myapp.com
> User-Agent: curl/7.47.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: nginx/1.10.0 (Ubuntu)
< Date: Sat, 21 Jan 2017 00:25:15 GMT
< Content-Type: application/json
< Transfer-Encoding: chunked
< Connection: keep-alive
< Strict-Transport-Security: max-age=63072000; includeSubdomains
< X-Frame-Options: DENY
< X-Content-Type-Options: nosniff
<
* Connection #0 to host myapp.com left intact
{"message": "Hello World"}
Note the very end, {"message": "Hello World"}, is the expected response.
Why does curl behave differently with respect to its trust of SSL certificate details, when running in verbose mode? This is not specified in the man page, so far as I can tell.
