title: curl self-signed certificate web service over SSL
body: <p>Hi I am having a big headache trying to curl a REST web service I created locally over SSL. <strong>I keep getting the message "curl: (60) SSL certificate problem: self signed certificate</strong>
  More details here: <a href="http://curl.haxx.se/docs/sslcerts.html" rel="nofollow">http://curl.haxx.se/docs/sslcerts.html</a>
  curl performs SSL certificate verification by default, using a "bundle"
   of Certificate Authority (CA) public keys (CA certs). If the default
   bundle file isn't adequate, you can specify an alternate file
   using the --cacert option.
  If this HTTPS server uses a certificate signed by a CA represented in
   the bundle, the certificate verification probably failed due to a
   problem with the certificate (it might be expired, or the name might
   not match the domain name in the URL).
  If you'd like to turn off curl's verification of the certificate, use
   the -k (or --insecure) option."</p>
  
  <p>Here the steps I followed</p>
  
  <ol>
  <li>created my own CA certificate with OpenSSL private certificate and key pair
  OpenSSL req -x509 -new -config c:\X509CA\openssl.cfg -days 365 -out c:\X509CA\ca\private_ca.pem -keyout c:\X509CA\ca\private_ca_pk.pem
  my CN: RESTfulCustomer</li>
  <li><p>created the keystore and mycert.pem
  keytool -genkey -validity 365 -alias myalias -keypass password -keystore myKeyStore.jks -storepass password
  used the same CN as above</p></li>
  <li><p>Created a certificate signing request
  keytool -certreq -alias myalias -file myCert_csr.pem -keypass password -keystore myKeyStore.jks -storepass password</p></li>
  <li><p>Signed the CSR with
  openssl 
  ca -config c:\X509CA\openssl.cfg -days 365 -in c:\path\to\key_store\myCert_csr.pem -out c:\path\to\key_store\myCert.pem</p></li>
  <li><p>Converted to PEM format - Convert the signed certificate, CertName.pem, to PEM only format, as follows:
  Openssl x509 -in c:\path\to\key_store\myCert.pem -out c:\path\to\key_store\myCert.pem -outform PEM</p></li>
  <li>concatenated the CA certificate file and the certName.pem
  copy myCert.pem + c:\X509CA\ca\new_ca.pem myCert.chain</li>
  <li>Updated keystore with the full certificate chain - Update the keystore, CertName.jks, by importing the full certificate chain for the certificate, as follows:
  keytool -import -file myCert.chain -keypass password -keystore myKeyStore.jks -storepass password
  finally imported it into firefox, updated my server.xml apache tomacat 7 starts ok and I could navigate to my ssl webpage with no problems. Curl does not work without using --insecure. My Curl command
  curl -v --cacert ca.pem  https://<code>localhost</code>:8443/RESTfulCustomer/customers.json</li>
  </ol>
  
  <p><strong>the curl command above gives me the message "curl: (60) SSL certificate problem: self signed certificate"</strong></p>
  
  <p>Running the Curl command for http//<code>localhost</code>:8080/RESTfuCustomer.customers.json with ssl disabled works fine.</p>
  
  <p>I imported the ca.pem into myKeyStore.jks and restarted Apache. 
  Environemnt windows 7,apache tomcat 7, spring security 3.1, curl 7.30.0 (i386-pc-win32) libcurl/7.30.0 OpenSSL/1.0.1c zlib/1.2.7</p>
  
  <p>any help would be really appreciated
  thanks</p>