curl: (60) Peer's Certificate issuer is not recognized.

Question

I am trying to install the .net Core SDK 2.0.0 on Centos 7 following the directions in ".NET Tutorial - Hello World in 5 minutes".

When I ran the first command

sudo rpm --import https://packages.microsoft.com/keys/microsoft.asc

I got this error:

curl: (60) Peer's Certificate issuer is not recognized.
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.
error: https://packages.microsoft.com/keys/microsoft.asc: import read failed(2)

I am behind a corporate proxy, and it seems this error is related to SSL certificate and curl, but I don't know how to fix it.

Also, I get a similar error when I use curl or wget to download the HTTPS URL.

Answer 1

I had the same issue and then just temporary turned off SSL check and installed the packages. But please be warned that this is bypassing a security measure so use with caution.

sudo vi /etc/yum.conf 

And then on the editor just add the following line

sslverify=false

Answer 2

Finally fixed it. Posting the answer here as reference.

• Get a copy of the company trusted root certificate
• If it's not in PEM format, convert it. (e.g. for DER run openssl x509 -in xxx.cer -inform der -outform pem -out xxx.pem)
• Install the ca-certificates package: yum install ca-certificates
• Enable the dynamic CA configuration feature: update-ca-trust force-enable
• Place the root certificate in /etc/pki/ca-trust/source/anchors/
• Run update-ca-trust extract to add the root to the system's trusted certificates

References:

https://support.ssl.com/Knowledgebase/Article/View/19/0/der-vs-crt-vs-cer-vs-pem-certificates-and-how-to-convert-them

http://manuals.gfi.com/en/kerio/connect/content/server-configuration/ssl-certificates/adding-trusted-root-certificates-to-the-server-1605.html

Answer 3

Check if your server has valid proxy settings.