<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Hi,</div><div class=""><br class=""></div><div class="">It doesn’t help. Still <span style="font-family: Menlo; font-size: 18px;" class="">{bad_cert,invalid_issuer}</span></div><div class=""><span style="font-family: Menlo; font-size: 18px;" class=""><br class=""></span></div><div class=""><span style="font-family: Menlo; font-size: 18px;" class=""><br class=""></span></div><br class=""><div><blockquote type="cite" class=""><div class="">16 июля 2015 г., в 20:29, Éric Pailleau <<a href="mailto:eric.pailleau@wanadoo.fr" class="">eric.pailleau@wanadoo.fr</a>> написал(а):</div><br class="Apple-interchange-newline"><div class="">Hi, try with depth = 3. Depth 0 to depth 2 is 3.<br class="">Regards<br class=""><br class="">Le 16 juil. 2015 15:15, Alex Hudich <<a href="mailto:alttagil@gmail.com" class="">alttagil@gmail.com</a>> a écrit :<br class=""><blockquote type="cite" class=""><br class="">When I tried to check connection with openssl command I’ve got w/o cacert.pem file:<br class=""><br class="">$ openssl s_client -connect <a href="http://nicemine.ru" class="">nicemine.ru</a>:443 -verify 99 <br class="">verify depth is 99<br class="">CONNECTED(00000003)<br class="">depth=2 /C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Certification Authority<br class="">verify error:num=19:self signed certificate in certificate chain<br class="">verify return:1<br class="">depth=2 /C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Certification Authority<br class="">verify return:1<br class="">depth=1 /C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 1 Primary Intermediate Server CA<br class="">verify return:1<br class="">depth=0 /<a href="mailto:C=KZ/CN=www.nicefiles.ru/emailAddress=webmaster@nicefiles.ru" class="">C=KZ/CN=www.nicefiles.ru/emailAddress=webmaster@nicefiles.ru</a><br class="">verify return:1<br class=""><br class=""><br class="">and with it<br class=""><br class="">$ openssl s_client -connect <a href="http://nicemine.ru" class="">nicemine.ru</a>:443 -verify 99 -CAfile cacert.pem<br class="">verify depth is 99<br class="">CONNECTED(00000003)<br class="">depth=2 /C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Certification Authority<br class="">verify return:1<br class="">depth=1 /C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 1 Primary Intermediate Server CA<br class="">verify return:1<br class="">depth=0 /<a href="mailto:C=KZ/CN=www.nicefiles.ru/emailAddress=webmaster@nicefiles.ru" class="">C=KZ/CN=www.nicefiles.ru/emailAddress=webmaster@nicefiles.ru</a><br class="">verify return:1<br class=""><br class="">so cacert.pem file contains enough info for StartCom certificates to be checked as valid.<br class=""><br class=""><br class="">Also I’ve tried to dig it more in erlang and I’ve found that I get error in OTP 18 too.<br class=""><br class="">And the reason for bad certificate error is {bad_cert,invalid_issuer}<br class=""><br class=""><br class=""><br class="">I also tried to add <a href="https://www.startssl.com/certs/sub.class1.server.ca.pem" class="">https://www.startssl.com/certs/sub.class1.server.ca.pem</a> file to cacert.pem but with no luck.<br class=""><br class=""><br class=""><br class=""><br class=""><br class=""><blockquote type="cite" class="">16 июля 2015 г., в 12:16, Alex Hudich <<a href="mailto:alttagil@gmail.com" class="">alttagil@gmail.com</a>> написал(а):<br class=""><br class="">Hi!<br class=""><br class=""><br class=""><br class="">wget <a href="http://curl.haxx.se/ca/cacert.pem" class="">http://curl.haxx.se/ca/cacert.pem</a><br class=""><br class="">and then <br class=""><br class="">ssl:connect( "<a href="http://www.nicemine.ru" class="">www.nicemine.ru</a>", 443, [{verify,verify_peer},{server_name_indication,"<a href="http://www.nicemine.ru" class="">www.nicemine.ru</a>"},{depth,2},{cacertfile,"cacert.pem"}] ).<br class=""><br class="">gives me {error,{tls_alert,"bad certificate"}}<br class=""><br class=""><br class=""><br class="">Why? Site can be opened ok in the browser.<br class=""><br class="">Erlang/OTP 17 [erts-6.3] <br class=""><br class=""><br class=""></blockquote><br class=""></blockquote></div></blockquote></div><br class=""></body></html>