daniel:// stenberg://

user reports curl doesn't work on his system, gets annoying cert error

turns out user is indeed getting MITMed so the check worked exactly as intended

https://github.com/curl/curl/issues/10551

Unable to use curl 7.87 for SSL connections on Windows 10 Pro · Issue #10551 · curl/curl

curl -v "https://www.google.com" * Trying [2404:6800:4009:82c::2004]:443... * Connected to www.google.com (2404:6800:4009:82c::2004) port 443 (#0) * ALPN: offers h2 * ALPN: offers http/1....

GitHub
Feb 17, 2023 at 3:28pmWeb
Show threadDan McDonaldFeb 17, 2023

@bagder

Bug closed.

Reason: Working as designed.

File this under problems you want to have, right?

Show threadsashk 🇺🇦Feb 17, 2023
@bagder it's either dns or antivirus for many issues.
Show threadJonathan DoughtyFeb 18, 2023
@bagder old employer used to MitM everything. The number of developer hours wasted discovering, and then getting an explanation from others on how to work around that by adding the corporate cert chain into tools’ expectations, always boggled my mind.
Show threadclacke: exhausted pixie dream boy 🇸🇪🇭🇰💙💛Feb 18, 2023
@jwd630 @bagder MitM everything is standard employer procedure these days.
Show threadJérôme MainaudFeb 18, 2023

@bagder indeed.

However, having details on the rejected certificate displayed in the first request would have avoided the user to put himself in danger by testing the query with "-k" to understand the reason why the requests were rejected.

So, maybe the error message could be slightly improved.

Show threaddaniel:// stenberg://Feb 18, 2023
@jxerome agreed! someone should work on that one day... =)
Show threadijk64✅Feb 19, 2023
@bagder @jxerome tempted…
Show threadOlivier DuclosFeb 18, 2023

@bagder A very nice tool to detect these situations from @jschauma :

https://www.netmeister.org/whatsthatcert/

Show threadeigenman Feb 19, 2023
@bagder Aka corporate proxy. 
Show threadChristophFeb 19, 2023
@bagder Recently got a new firewall installed a the company. It was advertised as "nothing changes". Turns out they enabled DPI as well. Without telling someone.
All the java-dev tools etc. complained. Our development department leader sent a furious email with the result that they switched it off.
Like either you fix this or we can't work!