Nss error 12286

Starting today (or within the last few days) I’ve hit an SSL error when trying to connect to github.com (e.g. to clone a repository).

This is a legacy server running Red Hat 4.1.2-33.

Here’s what it looks like when I try to connect:

$ curl https://www.github.com --verbose
* About to connect() to www.github.com port 443 (#0)
*   Trying 192.30.252.130... connected
* Connected to www.github.com (192.30.252.130) port 443 (#0)
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS error -12286
* Closing connection #0
* SSL connect error
curl: (35) SSL connect error

I can see from this page that the NSS error code is:

«Cannot communicate securely with peer: no common encryption
algorithm(s).»

The local and remote systems share no cipher suites in common. This
can be due to a misconfiguration at either end. It can be due to a
server being misconfigured to use a non-RSA certificate with the RSA
key exchange algorithm.

If I’m putting this altogether right, it appears that github.com has a recently updated SSL certificate and my server doesn’t have a cipher suite compatible with it. This is a legacy server so I’m not that surprised.

I’ve tried yum update nss (since that what curl seems to be using) as well as yum update openssl but none of those packages have updated.

I’ve also tried following the procedure outline here but to no avail.

I’m sort of hitting a wall with my knowledge of how TLS handshakes work to even troubleshoot this much deeper. Does anyone have any good ideas on how to start digging deeper and figuring out what’s going wrong and where I need to update things? Upgrading the OS is for the time being not an option.

Update

Digging further, it appears to be an issue with libcurl and the cipher it is using when connecting to github.com via git. I can get curl to work if I specify a compatible cipher explicitly:

$ curl https://github.com --cipher rsa_aes_128_sha

And I can even add the --cipher rsa_aes_128_sha parameter to a .curlrc file and have curl use that cipher by default. Unfortunately, this doesn’t seem to get picked up by the git command so it got me nowhere…nor could I find an alternate way to specify the cipher. This is what the result of a verbose git pull looks like on a github.com repository:

$ GIT_CURL_VERBOSE=1 git pull
* Couldn't find host github.com in the .netrc file, using defaults
* About to connect() to github.com port 443 (#0)
*   Trying 192.30.252.129... * Connected to github.com (192.30.252.129) port 443 (#0)
*   CAfile: /root/certs/cacert.pem
  CApath: none
* NSS error -12286
* Expire cleared
* Closing connection #0
* Couldn't find host github.com in the .netrc file, using defaults
* About to connect() to github.com port 443 (#0)
*   Trying 192.30.252.129... * Connected to github.com (192.30.252.129) port 443 (#0)
*   CAfile: /root/certs/cacert.pem
  CApath: none
* NSS error -12286
* Expire cleared
* Closing connection #0
error: SSL connect error while accessing https://github.com/twbs/bootstrap.git/info/refs
fatal: HTTP request failed

This might be a dead-end…looks like this guy on StackOverflow ran into the exact same issue.

Curl — View SSL certificate using CURL on Linux

When a server is configured to use SSL/TLS so that packets exchanged between the client and server are encrypted, the client will need to obtain the certificate from the server. For example, the following diagram illustrates how a client would obtain the certificate from an HTTPS web server.

The CURL command can be used to identify the certificate that the server presents to the client.

curl --verbose https://www.example.com

If a certificate is being presented, basic information about the certificate should be displayed.

* Server certificate:
*        subject:     CN=example.com,OU=foo,O=bar
*        start date:  Jan 01 2019
*        expire date: Jan 01 2021
*        common name: example.com
*        issuer:      CN=VeriSign Certification Authority

NSS error -12286

If you get NSS error 12286 when attempting to connect to a site, try updating curl and nss.

yum update curl
yum update nss

Target URL

You only need to use the hostname of the web server, such as www.example.com or www.google.com or www.freekb.net. In other words, there is no need to use a sub directory, such as www.example.com/foo/bar, since the certificate would be provided by just www.example.com.

curl --verbose https://www.example.com

grep the output

Curl writes output to stderr, not stdout, you’ll need to use 2>&1 if you want to pipe the output to grep.

curl --verbose https://www.example.com 2>&1 | grep expire

*        expire date: Jan 01 2021

define timeout to prevent hangs

Issues can cause cURL to hang sometimes. To prevent cURL from hanging for to long, you can use the -m or —max-time option followed by the number of seconds that cURL should hold tight before closing the connection to the remove server. In this second, cURL will timeout after 10 seconds.

curl --max-time 10 https://www.example.com

—insecure (certificate authority not recognized)

If the -k or —insecure option are not used, cURL will only get certificates that have been issued by a trusted certificate authority (CA). If you want to get certificates from both a trusted and untrusted certificate authority, use the -k or —insecure option.

curl --verbose --insecure https://www.example.com

Certificate chain

Let’s say there is a certificate chain, like this. cURL will only get the server certificate. If you need to determine each certificate used in the certificate chain, you are much better off using openSSL.

- example.com (root certificate)
-- example.com (intermediate certificate)
--- *.example.com (server certificate)

Did you find this article helpful?

If so, consider buying me a coffee over at

Я получаю сообщение об ошибке NSS -12286 при попытке загрузить страницу https с использованием сертификата ca, используя код cacertinpem.c curl c. я использую файл cacert.pem в коде alog с путем. но то же самое работает, когда я пытаюсь использовать curl -v «https://sampleserve.com:443», в этом случае ssl использует путь CA по умолчанию как «/etc/tls/certs/ca.budle.crt»

Но этот код c не работает как для расположения ca по умолчанию, так и для выбора внешнего пути ca.

В чем причина этой ошибки (NSS -12286).

Error:
* About to connect() to fiservices.sterlingbankng.com port 443 (#0)
*   Trying 1.1.1.1... * Connection timed out
*   Trying 1.1.1.2... * connected
* Connected to fiservices.sterlingbankng.com (1.1.1.2) port 443 (#0)
* Initializing NSS with certpath: /etc/pki/nssdb
*   CAfile: ./cacert.pem   CApath: ./cacert.pem
* NSS error -12286
* Error in TLS handshake, trying SSLv3...

GET /CanFI/ HTTP/1.1
Host: sampleserver.com
Accept: */*

* Connection died, retrying a fresh connect
* Closing connection #0
* Issue another request to this URL: 'https://sampleserver.com'
* About to connect() to sampleserver.com port 443 (#0)
*   Trying 1.1.1.1... * Connection timed out
*   Trying 1.1.1.2... * connected
* Connected to sampleserver.com (1.1.1.2) port 443 (#0)
* TLS disabled due to previous handshake failure
*   CAfile: ./cacert.pem
  CApath: ./cacert.pem
* NSS error -12286
* Closing connection #0
* SSL connect error

Образец кода:

size_t writefunction( void *ptr, size_t size, size_t nmemb, void *stream)
{
  fwrite(ptr,size,nmemb,stream);              

  return(nmemb*size);                   
}

static CURLcode sslctx_function(CURL * curl, void * sslctx, void * parm)
{

  X509_STORE * store;

  X509 * cert=NULL;   

  BIO * bio;                             

  char * mypem = "-----BEGIN CERTIFICATE-----n"     "-----END CERTIFICATE-----n";  //public certificate    

}     

int main(void)    
{

  CURL * ch;

  CURLcode rv;

  rv=curl_global_init(CURL_GLOBAL_ALL);

  ch=curl_easy_init();

  rv=curl_easy_setopt(ch,CURLOPT_VERBOSE, 1L);

  rv=curl_easy_setopt(ch,CURLOPT_HEADER, 0L);

  rv=curl_easy_setopt(ch,CURLOPT_NOPROGRESS, 1L);

  rv=curl_easy_setopt(ch,CURLOPT_NOSIGNAL, 1L);

  rv=curl_easy_setopt(ch,CURLOPT_WRITEFUNCTION, *writefunction);

  rv=curl_easy_setopt(ch,CURLOPT_WRITEDATA, stdout);

  rv=curl_easy_setopt(ch,CURLOPT_HEADERFUNCTION, *writefunction);

  rv=curl_easy_setopt(ch,CURLOPT_WRITEHEADER, stderr);

  rv=curl_easy_setopt(ch,CURLOPT_SSLCERTTYPE,"PEM");  

  rv=curl_easy_setopt (ch, CURLOPT_CAPATH, "./cacert.pem" );  

  rv=curl_easy_setopt (ch, CURLOPT_CAINFO, "./cacert.pem" ); 

  rv=curl_easy_setopt(ch,CURLOPT_SSL_VERIFYPEER,1L); 

  rv=curl_easy_setopt(ch, CURLOPT_URL, "https://");   

  rv=curl_easy_perform(ch);           

  if (rv==CURLE_OK)             

    printf("*** transfer succeeded ***n"); 

  else                   

    printf("*** transfer failed ***n"); 

  rv=curl_easy_setopt(ch,CURLOPT_SSL_CTX_FUNCTION, *sslctx_function); 

  rv=curl_easy_perform(ch);              

  if (rv==CURLE_OK)             

    printf("*** transfer succeeded ***n");               
  else             

    printf("*** transfer failed ***n");               

  curl_easy_cleanup(ch);  

  curl_global_cleanup();  

  return rv;               
}

Спасибо