小编Rup*_*Rup的帖子

我们curl无法连接到 HTTPS 服务器时遇到问题：

$ curl https://the-problem-site.com    (not the real URL!)   
curl: (35) error:14077458:SSL routines:SSL23_GET_SERVER_HELLO:reason(1112)

1112SSL_R_TLSV1_UNRECOGNIZED_NAME在ssl.h.

如果我openssl s_client -connect the-problem-site.com:443改为尝试，那么我会看到

CONNECTED(00000003)   
depth=1 /C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA   
verify error:num=20:unable to get local issuer certificate   
verify return:0   

Certificate chain   
0 s:/serialNumber=xx/C=xx/ST=xx/L=xxxx/O=xx/OU=xx/CN=the-problem-site.com   
i:/C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA   
1 s:/C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA   
i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA   

即看起来问题在于它不信任/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA. 但是，该证书已安装：它是/etc/ssl/certs/GeoTrust_Global_CA.pem，如果我运行

openssl s_client -connect the-problem-site.com:443 -CAfile /etc/ssl/certs/GeoTrust_Global_CA.pem

然后一切正常。证书也以哈希命名的文件形式存在b0f3e76e.0，它位于ca-certificates.crt. 但是，据我所知， …