title: How to use 'curl' to call a secure (https) WCF service - GET request only
body: <p>The context is i created a WCF Service, hosted in IIS using https.</p>
  
  <p>I have no issues with the WCF Service itself, it is working as it should; I can navigate to the service page at 
  <a href="https://myhost/VirtualAppOnIIS/Some/WCF/Service/Here/V1" rel="nofollow noreferrer">https://myhost/VirtualAppOnIIS/Some/WCF/Service/Here/V1</a>
  using a Browser (IE in my case).</p>
  
  <p>The "lock" symbol displays ok, and i can view the certificate info; More cert info is:</p>
  
  <ul>
  <li>root CA is Verisign, which issued a Verisign Intermediate cert, which issued 
  my server cert (let's call it "myhost")</li>
  <li>"Key Usage" set as critical, purposes are: Digital Signature, Non-Repudiation, Key Encipherment, Data Encipherment (f0)</li>
  <li>The "Extended Key Usage" is absent, so i can conclude it is undefined / not set by the certificate issuer (and therefore this cert can be used as both Server cert or Client cert)</li>
  </ul>
  
  <p>So far so good. My real issue is how to get curl to make a /GET https request (similar to the way the Browser does it).</p>
  
  <p><strong>Attempt #1.</strong></p>
  
  <blockquote>
    <p>curl --tlsv1.2 <a href="https://myhost/VirtualAppOnIIS/Some/WCF/Service/Here/V1" rel="nofollow noreferrer">https://myhost/VirtualAppOnIIS/Some/WCF/Service/Here/V1</a> -v</p>
  </blockquote>
  
  <pre><code>*   Trying 192.168.1.114...
  * TCP_NODELAY set
  * Connected to myhost (192.168.1.114) port 443 (#0)
  * ALPN, offering h2
  * ALPN, offering http/1.1
  * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
  * successfully set certificate verify locations:
  *   CAfile: C:\SETUPS\curl\curl-ca-bundle.crt   CApath: none
  * TLSv1.2 (OUT), TLS header, Certificate Status (22):
  * TLSv1.2 (OUT), TLS handshake, Client hello (1):
  * TLSv1.2 (IN), TLS handshake, Server hello (2):
  * TLSv1.2 (IN), TLS handshake, Certificate (11):
  * TLSv1.2 (OUT), TLS alert, Server hello (2):
  * SSL certificate problem: unsupported certificate purpose
  * stopped the pause stream!
  * Closing connection 0
  * TLSv1.2 (OUT), TLS alert, Client hello (1): curl: (60) SSL certificate problem: unsupported certificate purpose 
  More details here: https://curl.haxx.se/docs/sslcerts.html 
  ...etc ... 
  If you'd like to turn off curl's verification of the certificate, use  the -k (or --insecure) option.
  </code></pre>
  
  <p>We can see an error after server hello (2):</p>
  
  <blockquote>
    <p>SSL certificate problem: unsupported certificate purpose</p>
  </blockquote>
  
  <p>I made sure I have both certificates for Intermediate and Root CA concatenated within the file curl-ca-bundle.crt (and nothing else), which curl finds by default, and i don't believe it's a chain validation issue, seems a cert purpose problem as suggested by the error message.</p>
  
  <p><strong>Attempt #2</strong></p>
  
  <p>Bybass https validation, as suggested by the curl output, using the -k switch. Yes, it works !</p>
  
  <blockquote>
    <p>curl --tlsv1.2 <a href="https://myhost/VirtualAppOnIIS/Some/WCF/Service/Here/V1" rel="nofollow noreferrer">https://myhost/VirtualAppOnIIS/Some/WCF/Service/Here/V1</a> -v -k</p>
  </blockquote>
  
  <pre><code>* TLSv1.2 (IN), TLS handshake, Certificate (11):
  * TLSv1.2 (IN), TLS handshake, Server key exchange (12):
  * TLSv1.2 (IN), TLS handshake, Server finished (14):
  * TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
  * TLSv1.2 (OUT), TLS change cipher, Client hello (1):
  * TLSv1.2 (OUT), TLS handshake, Finished (20):
  * TLSv1.2 (IN), TLS change cipher, Client hello (1):
  * TLSv1.2 (IN), TLS handshake, Finished (20):
  * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-SHA384
  * ALPN, server did not agree to a protocol
  * Server certificate:
  *  subject: C=country; ST=state; O=Some Company PTY LIMITED; CN=myhost
  *  start date: Apr 26 00:00:00 2017 GMT
  *  expire date: Mar 29 23:59:59 2019 GMT
  *  issuer: O=VeriSign; OU=Whatever PKI; CN=Whatever Intermediate CA
  *  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
   GET /VirtualAppOnIIS/Some/WCF/Service/Here/V1 HTTP/1.1
   Host: myhost
   User-Agent: curl/7.53.1
   Accept: */*
  
   HTTP/1.1 200 OK
   Cache-Control: private
   Content-Type: text/html; charset=UTF-8
   Server: Microsoft-IIS/8.5
   Set-Cookie: ASP.NET_SessionId=iy1s4q1hwkncywi5m0w0coch; path=/; HttpOnly
   X-AspNet-Version: 4.0.30319
   X-Powered-By: ASP.NET
   Date: Wed, 02 May 2018 07:08:30 GMT
   Content-Length: 3236
  
  &lt;HTML&gt;&lt;HEAD&gt;
  etc... etc... more html for wcf service page... etc ... etc...
  &lt;/BODY&gt;&lt;/HTML&gt;
   Connection #0 to host myhost left intact
  </code></pre>
  
  <p>So to re-phrase the question, if it is a cert. purpose issue (as suggested in attempt #1), what cert. purposes or settings or configurations are required (when issuing the cert) to make curl and WCF with TLS work ?</p>
  
  <p>Incidentally i am using curl on Windows from <a href="https://winampplugins.co.uk/curl/" rel="nofollow noreferrer">https://winampplugins.co.uk/curl/</a></p>