Skip to content

curl (60) peer’s certificate issuer is not recognized.

Last updated on March 13, 2019

If you get curl error  “(60) peer’s certificate issuer is not recognized” while trying to curl something from another server, it means that your server does not have target’s server trusted certificates.

To solve this in a quick way, we can bypass the error simply adding “-k” or “–insecure” to curl.

or executing for wget:

echo "check_certificate = off" >> ~/.wgetrc

and for curl :

You can add insecure option to your $HOME/.curlrc file:
$ vi $HOME/.curlrc
Append the following:

insecure

!But this won’t resolve the issue, you will only bypass the error, so be careful.
To make it right and secure follow the resolution below.

To resolve this:

  1. Open a webpage that uses the CA with Firefox
  2. Click the lock-icon in the addressbar -> show information -> show certificate, the certificate viewer will open
  3. click details and choose the certificate of the certificate-chain, you want to import to CentOS
  4. click “Export…” and save it as .crt file
  5. Copy the .crt file to /etc/pki/ca-trust/source/anchors on your CentOS machine
  6. run update-ca-trust extract
  7. test it with wget https://thewebsite.org or curl https://thewebsite.org

    On debian and ubuntu the directory is /usr/local/share/ca-certificates/ and the command to update is update-ca-certificates

Published inLinuxShell