title: CURL fails to load https resources; NSS error -8181
body: <p>I've been trying to configure fresh dedicated server, when found a strange behavior of curl on CentOS 6 (and 7):</p>
  
  <pre><code>curl "https://google.com"
  </code></pre>
  
  <p>returns</p>
  
  <pre><code>curl (60): Peer certificate cannot be authenticated with known CA certificates
  </code></pre>
  
  <p>Seems like curl does not know anything about CA installed on current system.</p>
  
  <pre><code># curl https://google.com --verbose
  * About to connect() to google.com port 443 (#0)
  *   Trying 172.217.25.174... connected
  * Connected to google.com (172.217.25.174) port 443 (#0)
  * Initializing NSS with certpath: sql:/etc/pki/nssdb
  *   CAfile: /etc/pki/tls/certs/ca-bundle.crt
    CApath: none
  * Remote Certificate has expired.
  * NSS error -8181
  * Closing connection #0
  * Peer certificate cannot be authenticated with known CA certificates
  curl: (60) Peer certificate cannot be authenticated with known CA certificates
  More details here: http://curl.haxx.se/docs/sslcerts.html
  
  curl performs SSL certificate verification by default, using a "bundle"
   of Certificate Authority (CA) public keys (CA certs). If the default
   bundle file isn't adequate, you can specify an alternate file
   using the --cacert option.
  If this HTTPS server uses a certificate signed by a CA represented in
   the bundle, the certificate verification probably failed due to a
   problem with the certificate (it might be expired, or the name might
   not match the domain name in the URL).
  If you'd like to turn off curl's verification of the certificate, use
   the -k (or --insecure) option.
  </code></pre>
  
  <p><code>--insecure</code> is not good for me.</p>
  
  <p>I've tried to:</p>
  
  <ul>
  <li>reinstall <code>ca-certificates</code>,</li>
  <li>extract certificates via <code>update-ca-trust extract</code></li>
  <li>download third-party ca certificate</li>
  <li>even set a <code>--cacert</code> option to curl execution directly</li>
  </ul>
  
  <p>but it does not help me.</p>
  
  <p>First thought - okay, fresh OS could not has actual version of certificates, but what if I do <code>yum update -y</code>? Should be actual, shouldn't it?</p>
  
  <p>I've checked previously asked questions like this <a href="https://stackoverflow.com/questions/19915693/get-60-error-with-curl-l-https-get-rvm-io-bash-s">get-60-error-with-curl</a> and many others.</p>