curl: (77) error setting certificate verify locations

Where you see it

curl exits with code 77, CURLE_SSL_CACERT_BADFILE: “Problem with reading the SSL CA cert (path? access rights?)” (libcurl error codes). The wording depends on curl’s version and TLS library. With OpenSSL 1.1.1:

$ curl https://example.com/
curl: (77) error setting certificate verify locations:
  CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs

Other versions say the same thing differently (curl’s openssl.c):

• curl with OpenSSL 3, up to curl 8.16: curl: (77) error setting certificate file: /etc/ssl/certs/ca-certificates.crt
• curl 8.17 and later: error adding trust anchors from file: … (with OpenSSL 1.x: error adding trust anchors from locations:)
• Git for Windows’ curl with Schannel: curl: (77) schannel: failed to open CA file 'C:/certs/ca.pem': The system cannot find the path specified.
• git with libcurl’s generic text: fatal: unable to access 'https://git.example.com/team/app.git/': Problem with the SSL CA cert (path? access rights?)

What it means

To check a server’s certificate, curl needs a trust store: a file (a CA bundle) or a directory of root certificates in PEM format. Code 77 means curl could not load the file it was given, so it stopped before checking the server at all. The server is not the problem; the client’s configuration is.

Likely causes

The CA bundle is not installed

Minimal container images often contain curl but no CA bundle. Confirm which file curl tries to use, and whether it exists:

curl -v https://example.com/ 2>&1 | grep -E 'CAfile|CApath'
ls -l /etc/ssl/certs/ca-certificates.crt

Fix: install the bundle:

apt-get install -y ca-certificates     # Debian and Ubuntu
apk add ca-certificates                # Alpine
dnf install -y ca-certificates         # Fedora and RHEL

For containers, put the install command in the Dockerfile, so that every container built from the image has the bundle.

A setting points to the wrong file

Many settings can tell curl or programs built on libcurl which CA file to use: --cacert, the CURL_CA_BUNDLE and SSL_CERT_FILE environment variables, cacert in .curlrc, git’s http.sslCAInfo or GIT_SSL_CAINFO, and PHP’s curl.cainfo or openssl.cafile. A path that was right on another machine, or before an upgrade moved the file, gives exactly this error.

Confirm:

env | grep -E 'CURL_CA_BUNDLE|SSL_CERT_FILE|SSL_CERT_DIR|GIT_SSL_CAINFO'
git config --show-origin --get-all http.sslCAInfo
php -i | grep -E 'curl.cainfo|openssl.cafile'

Fix: correct the path or remove the setting so the default applies. If you added the setting for a company root, add that root to the system store instead: How to trust a private root CA on Linux or How to work behind a TLS-inspecting corporate proxy, safely.

A wrong --capath directory often does not give code 77: curl then finds no root and fails later with code 60, unable to get local issuer certificate.

The file cannot be read

The file exists but the user running curl may not read it, for example after a copy with the wrong permissions, or a Windows path used inside WSL. Confirm with ls -l and by reading it as that user (head -1 /path/to/ca.pem). Fix: chmod 644 /path/to/ca.pem, or use a path the process can reach.

The file is not PEM

A CA certificate saved in DER format (often .cer or .crt on Windows), a PKCS #12 file or an HTML error page saved by mistake cannot be loaded. Confirm: a PEM file starts with -----BEGIN CERTIFICATE-----, and OpenSSL can read it:

head -1 corp-root.pem
openssl x509 -in corp-root.pem -noout -subject -enddate

Fix: convert a DER file to PEM:

openssl x509 -inform DER -in corp-root.cer -out corp-root.pem

See How to convert between DER and PEM.

Check yours

Try it: Certificate decoderOpen the full tool

Runs in your browser. Nothing you paste is sent anywhere.

Paste a certificate

Try a sampleChoose a sample…A website certificate (www.example.com)An expired certificateA wildcard certificate (*.example.com)A certificate with a Common Name but no SANA self-signed root CAA complete chain: leaf, intermediate and root

-----BEGIN CERTIFICATE----- MIIFxDCCA6ygAwIBAgIQV3/H8mpwNp5raCafwOtSezANBgkqhkiG9w0BAQsFADB7 MQswCQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8gdG8gSGVybzEnMCUGA1UE CxMeU2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVkMSgwJgYDVQQDEx9QS0kg WmVybyB0byBIZXJvIFNhbXBsZSBSb290IENBMCAXDTI1MDEwMTAwMDAwMFoYDzIw NTAwMTAxMDAwMDAwWjB7MQswCQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8g dG8gSGVybzEnMCUGA1UECxMeU2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVk MSgwJgYDVQQDEx9QS0kgWmVybyB0byBIZXJvIFNhbXBsZSBSb290IENBMIICIjAN BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAnYTGHkYMca54QPkZcZENin3BHB3t uKdHkDZeKZvJHWqpfXpcZfusLvtJFeTrwWlEDBJuV20vmhaLeV29QeYKaIkm1Ul2 qCkrLUpWn/W9CPosfVqMd1nOrd+Ka9iPSeKlW3YX1P5WqQEjieJhBzT9comdj8qN /PynceTDcLa2mgYw7QhU8trBoLzhYqIJFfoUBk+7lahae8b9G5wKCbDicRM8/ATt 0dO9jCxi6RxJpkKl24ULgNOuFP9gG4nubWA8+BaMeM0LU64wNciFofgM2g/3iHHn zmcoe1z80C7WN+GuzNkWkN8D/tcqrbua0O5fREKKw6PyyxwQsjeMghpxLb0h1KeA ihpQMVgpWbhRkkpvF5odkF9vTJP89Z2y+8cgnUMyTpXATrt8KgC5LdWo5mlTNXC/ MvbCUb1Vz9bvcEx2y29tUeLIAUmyBzhF7zgMUPAOtDbLLCuxgR78T2TWaXB/8WBT XL44Wk5rOe7U+KuBr/t12AcZjaq0AGiNsvfd1P+IFbRivElegpdrM+S3arjOjptP M9sUl9Hc+cszaTpEVcQFFxcIyvq5HVjTlZr4vLKdqlhSkQB9hZUFuWNpnUZEYEnA 1vn/GkHNTJ6pv8XxdNXkFeRaUv3ajCn7CQ3UP/EXJqzBw5fl6aa9lqKTS5kF9rgw EIhwNaSd2O557KUCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E BAMCAQYwHQYDVR0OBBYEFIVx1Hy1TuED0pMkxEcdM+DWWPGiMA0GCSqGSIb3DQEB CwUAA4ICAQBMdaOOM84aoItvumQ/sNzOhXvmLwboTb3oe67wda9TvPMSf2aP3JtP UWsR/9UbZgNE9M41p2+XZlVpsGP1BLEvi5ZwfMWmR876Mw1Zkt8ouY3DWN08egnm IdV2vKwDHhDE93IQ12fjNc8iuMCasoYiXTsmXx3R/+PkNbeBAupZEk6EwTr75PCY IJ2cheL7jQ06xeCCZv815rG+63jGk3tys7A+nUXKqOp9oN/dkEhi+YWiHG9UJ2w/ BDZCFUUoJBia7C3+hcXZAVxtWwTy0A5T/plEsqGcdfCMFA4cOFstthyS/Wnnuw8y cpSiXdUAQbLkJ+CGavr6MXVmDicmnV9p3Pv9EbpGPV8UlxwvoQMf+ajEE4EAaJkN Gc85wOC7Y7wwWkBnzjiyLztqRqOFdHEdM13V+2Gw2545Jk8o2gRizBQ6Ey6rlt2u YdYFqFFQhe2H+VqvJiLKefkN1mVQhvhfAvuoxZWIsDtyJWGs12L06xMj3wG98kne mUJjPzze3swZU39eiaC1MBs6U0oLZE6ZqubmjJd/ppmGyK+7o2SMi0juouvw6rcA J9eUJQLNpiVKmiwzKvPejASpunK5B5JO3Y7NAb4SVU22ItR73bBiRAugPwVajlBN RGcjMkDSiW07/dhN6GgjsNAzXHcTR7/nbILOAWbhBstNFK1mgejlbQ== -----END CERTIFICATE-----

PEM text, several PEM blocks, or a .pem, .crt, .cer or .der file (drop it on the box). Certificates are public, so they are safe to paste.

DecodeClearChoose a file

Paste the contents of the CA file curl should load. If the decoder can read it, it is valid PEM, and you see whose root certificate it is and when it expires.

Learn why

• Who do we trust? CAs, trust stores and self-signed certificates: where each tool finds its trusted roots.
• Related: unable to get local issuer certificate and Go’s certificate signed by unknown authority, the usual next error in images without CA certificates.

In the gameLevel 12: Who do we trust?Registry of Roots, Keystone. In development