curl (77) problem with the SSL CA cert
curl exits with 77 (CURLE_SSL_CACERT_BADFILE) when the CA bundle file it was pointed at is missing or unreadable. Three causes: (1) /etc/ssl/certs/ca-certificates.crt missing — the ca-certificates package is not installed, (2) inside a container (alpine, scratch) the CA bundle is absent, (3) the CURL_CA_BUNDLE env var points at a non-existent file.
Below: details, example, related, FAQ.
Details
- Default bundle paths: /etc/ssl/certs/ca-certificates.crt (Debian), /etc/pki/tls/certs/ca-bundle.crt (RHEL)
- Alpine: apk add ca-certificates; then update-ca-certificates
- Docker scratch: copy the bundle from an unpacked image
- --cacert /path/to/ca.pem — per-request override
- -k / --insecure skips verify — debug only, never production
Example
# Debian/Ubuntu: install bundle
$ apt-get install ca-certificates
# Alpine (Docker)
$ apk add --no-cache ca-certificates
$ update-ca-certificates
# Debug — which bundle curl sees
$ curl -v https://example.com 2>&1 | grep -i "CAfile\|CApath"
# Default via env
$ export CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crtRelated
Why teams trust us
How it works
Enter domain
TLS chain verified
Expiry date & vulnerabilities
What Does the SSL Check Cover?
SSL/TLS is the encryption protocol that protects data between the browser and server. Our tool analyzes the certificate, chain of trust, TLS version, and knownvulnerabilities.
Certificate Details
Issuer, validity period, signature algorithm, covered domains (SAN), and validation type (DV/OV/EV).
Chain of Trust
Full chain verification: from leaf certificate through intermediates to root CA.
TLS Analysis
Protocol version (TLS 1.2/1.3), cipher suites, Perfect Forward Secrecy (PFS) support.
Expiry Alerts
Set up a monitor — get Telegram and email alerts 30/14/7 days before expiration.
DV vs OV vs EV Certificates
- Confirms domain ownership only
- Issued in minutes automatically
- Free via Let's Encrypt
- Suitable for most websites
- Most common certificate type
- Organization (OV) or Extended Validation (EV)
- Issued in 1-5 business days
- Costs $50 to $500/year
- For finance, e-commerce, government sites
- Increases user trust
Who uses this
DevOps
SSL certificate monitoring
Security
TLS config audit
SEO
HTTPS as ranking factor
E-commerce
customer trust
Common Mistakes
www and subdomains.Best Practices
Strict-Transport-Security header forces browsers to always use HTTPS.Get more with a free account
SSL certificate monitoring, check history and alerts 30 days before expiry.
Sign up freeFrequently Asked Questions
Alpine Docker — safe?
Yes if you add ca-certificates. Scratch — you need to copy the bundle from a builder image.
CI / CD?
Images like alpine:latest usually ship ca-certificates. gcr.io/distroless/base too. Check your Dockerfile.
Self-signed?
Either --cacert pointing at the self-signed CA, or import into the system bundle via update-ca-certificates.