我在 Windows 上尝试通过 SSL 使用 cURL，但遇到了我绝对无法弄清楚的证书问题。

例如，这是我正在尝试运行的示例。

$ curl "https://google.com" --ntlm -v --negotiate -u USERNAME:PASSWORD --proxy "PROXY" --cert "c:\temp\curl-ca-bundle.crt"
* Adding handle: conn: 0x147ce88
* Adding handle: send: 0
* Adding handle: recv: 0
* Curl_addHandleToPipeline: length: 1
* - Conn 0 (0x147ce88) send_pipe: 1, recv_pipe: 0
* About to connect() to proxy PROXY port 8080 (#0)
*   Trying 192.168.134.80...
* Connected to PROXY (PROXY_IP) port 8080 (#0)
* Establish HTTP proxy tunnel to google.com:443
> CONNECT google.com:443 HTTP/1.1
> Host: google.com:443
> User-Agent: curl/7.30.0
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 200 Connection established
<
* Proxy replied OK to CONNECT request
* unable to use client certificate (no key found or wrong pass phrase?)
* Closing connection 0
curl: (58) unable to use client certificate (no key found or wrong pass phrase?)

尝试使用 --cacert 而不是 --cert 会产生以下消息 -

* Adding handle: conn: 0x130cdf8
* Adding handle: send: 0
* Adding handle: recv: 0
* Curl_addHandleToPipeline: length: 1
* - Conn 0 (0x130cdf8) send_pipe: 1, recv_pipe: 0
* About to connect() to proxy PROXY port 8080 (#0)
*   Trying 192.168.135.80...
* Connected to PROXY (PROXY_IP) port 8080 (#0)
* Establish HTTP proxy tunnel to google.com:443
> CONNECT google.com:443 HTTP/1.1
> Host: google.com:443
> User-Agent: curl/7.30.0
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 200 Connection established
<
* Proxy replied OK to CONNECT request
* successfully set certificate verify locations:
*   CAfile: c:\temp\curl-ca-bundle.crt
  CApath: none
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS alert, Server hello (2):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use the
-k (or --insecure) option.

我的 curl-ca-bundle.crt 来自 here ，这是几分钟前更新的。我确保该文件未被 Windows 阻止。

无论如何，我都在公司代理和防火墙后面。我已经阅读了有关此问题的所有内容，但不知道下一步该怎么做。我知道我可以忽略 SSL，但我想不惜一切代价避免这种情况。

最佳答案

For what it's worth, I'm behind a corporate proxy and firewall. I have read everything I could find on this issue and don't know what to do next. I do realize I can ignore SSL, but would like to avoid this at all costs.

我建议防火墙进行 SSL 拦截，即它作为中间人工作。为了检查加密连接，它会将其拆分为两个加密连接，但当然它无法使用原始证书对浏览器和代理之间的连接进行签名。因此，它将创建一个新证书，由特定于防火墙的 CA 签名。您需要将此 CA 添加到您的 CA 包中，否则验证将失败。

有关更多详细信息，您可以尝试使用 Web 浏览器访问目标站点并检查签署服务器证书的 CA，或者向您的系统管理员询问 SSL 拦截的详细信息。

关于windows - cURL 在访问 SSL 时无法使用 curl-ca-bundle.crt，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/24957867/