SSL 证书验证失败，如何找出导致它的原因？

Question

我最近在 Namecheap 获得了 PositiveSSL 证书并将其安装在我的服务器上。从 Firefox 访问站点工作正常，但从 Ruby 的 net/https 库访问它不起作用：即使我指定了证书的路径并且我检查了文件是否可读，它也无法验证连接证书. Curl 也失败了：

curl --cacert /path/to/cert https://mysite.com/

它只是这样说：

curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

“证书验证失败”不是一个非常有用的错误消息。如何找出我的证书到底有什么问题以及如何处理？我发现它在浏览器中工作但在其他任何地方都无法工作，这令人困惑。

Answer 1

看起来curl 要求CA 证书文件包含链中的所有证书。我已经下载了所有这些并将它们组合成一个文件，现在 Curl 和 Ruby 都很满意。