> Fix curl: (77) error setting certificate verify locations: find which CA file curl loads, then install the bundle, fix the path or convert the file. Source: https://pkizerotohero.com/errors/curl-77-certificate-verify-locations/ · Last reviewed: 2026-10-20 - curl - Exact text checked with the real tool # curl: (77) error setting certificate verify locations Also seen in: git, PHP, other programs built on libcurl **In one sentence:** curl could not load the CA certificates it was told to use: the bundle file is missing, unreadable or not PEM. The server was never checked. [Check yours: Certificate decoder](https://pkizerotohero.com/tools/decoder/) ## Where you see it curl exits with code 77, `CURLE_SSL_CACERT_BADFILE`: “Problem with reading the SSL CA cert (path? access rights?)” ([libcurl error codes](https://curl.se/libcurl/c/libcurl-errors.html)). The wording depends on curl’s version and TLS library. With OpenSSL 1.1.1: ```text $ curl https://example.com/ curl: (77) error setting certificate verify locations: CAfile: /etc/ssl/certs/ca-certificates.crt CApath: /etc/ssl/certs ``` Other versions say the same thing differently ([curl’s openssl.c](https://github.com/curl/curl/blob/master/lib/vtls/openssl.c)): - curl with OpenSSL 3, up to curl 8.16: `curl: (77) error setting certificate file: /etc/ssl/certs/ca-certificates.crt` - curl 8.17 and later: `error adding trust anchors from file: …` (with OpenSSL 1.x: `error adding trust anchors from locations:`) - Git for Windows’ curl with Schannel: `curl: (77) schannel: failed to open CA file 'C:/certs/ca.pem': The system cannot find the path specified.` - git with libcurl’s generic text: `fatal: unable to access 'https://git.example.com/team/app.git/': Problem with the SSL CA cert (path? access rights?)` ## What it means To check a server’s certificate, curl needs a [trust store](https://pkizerotohero.com/handbook/glossary/#trust-store): a file (a CA bundle) or a directory of [root certificates](https://pkizerotohero.com/handbook/glossary/#root-certificate) in [PEM](https://pkizerotohero.com/handbook/glossary/#pem) format. Code 77 means curl could not load the file it was given, so it stopped before checking the server at all. The server is not the problem; the client’s configuration is. ## Likely causes ### The CA bundle is not installed Minimal container images often contain curl but no CA bundle. **Confirm** which file curl tries to use, and whether it exists: ```bash curl -v https://example.com/ 2>&1 | grep -E 'CAfile|CApath' ls -l /etc/ssl/certs/ca-certificates.crt ``` **Fix:** install the bundle: ```bash apt-get install -y ca-certificates # Debian and Ubuntu apk add ca-certificates # Alpine dnf install -y ca-certificates # Fedora and RHEL ``` For containers, put the install command in the Dockerfile, so that every container built from the image has the bundle. ### A setting points to the wrong file Many settings can tell curl or programs built on libcurl which CA file to use: `--cacert`, the `CURL_CA_BUNDLE` and `SSL_CERT_FILE` environment variables, `cacert` in `.curlrc`, git’s `http.sslCAInfo` or `GIT_SSL_CAINFO`, and PHP’s `curl.cainfo` or `openssl.cafile`. A path that was right on another machine, or before an upgrade moved the file, gives exactly this error. **Confirm:** ```bash env | grep -E 'CURL_CA_BUNDLE|SSL_CERT_FILE|SSL_CERT_DIR|GIT_SSL_CAINFO' git config --show-origin --get-all http.sslCAInfo php -i | grep -E 'curl.cainfo|openssl.cafile' ``` **Fix:** correct the path or remove the setting so the default applies. If you added the setting for a company root, add that root to the system store instead: [How to trust a private root CA on Linux](https://pkizerotohero.com/guides/add-root-ca-linux/) or [How to work behind a TLS-inspecting corporate proxy, safely](https://pkizerotohero.com/guides/corporate-proxy-certificates/). A wrong `--capath` directory often does not give code 77: curl then finds no root and fails later with code 60, [unable to get local issuer certificate](https://pkizerotohero.com/errors/curl-unable-to-get-local-issuer-certificate/). ### The file cannot be read The file exists but the user running curl may not read it, for example after a copy with the wrong permissions, or a Windows path used inside WSL. **Confirm** with `ls -l` and by reading it as that user (`head -1 /path/to/ca.pem`). **Fix:** `chmod 644 /path/to/ca.pem`, or use a path the process can reach. ### The file is not PEM A CA certificate saved in DER format (often `.cer` or `.crt` on Windows), a PKCS #12 file or an HTML error page saved by mistake cannot be loaded. **Confirm:** a PEM file starts with `-----BEGIN CERTIFICATE-----`, and OpenSSL can read it: ```bash head -1 corp-root.pem openssl x509 -in corp-root.pem -noout -subject -enddate ``` **Fix:** convert a DER file to PEM: ```bash openssl x509 -inform DER -in corp-root.cer -out corp-root.pem ``` See [How to convert between DER and PEM](https://pkizerotohero.com/guides/convert-der-pem/). Warning Why -k is the wrong way out `curl -k` makes the error disappear because curl then skips certificate checks completely, including the ones that protect you from an attacker. Install the CA bundle or fix the path instead; that takes a minute and keeps every connection checked. ## Check yours *Interactive tool: Certificate decoder (runs in the browser at [/tools/decoder/](https://pkizerotohero.com/tools/decoder/))* Paste the contents of the CA file curl should load. If the decoder can read it, it is valid PEM, and you see whose root certificate it is and when it expires. ## Learn why - [Who do we trust? CAs, trust stores and self-signed certificates](https://pkizerotohero.com/handbook/trust-stores/): where each tool finds its trusted roots. - Related: [unable to get local issuer certificate](https://pkizerotohero.com/errors/curl-unable-to-get-local-issuer-certificate/) and Go’s [certificate signed by unknown authority](https://pkizerotohero.com/errors/go-x509-unknown-authority/), the usual next error in images without CA certificates. **Early edition.** Checked against the standards; an independent expert review is in progress. Found a mistake? [Tell us](https://pkizerotohero.com/contact/?topic=content-error&page=/errors/curl-77-certificate-verify-locations/). Last reviewed 20 October 2026Edition 0.9 ## Learn why it happens - [Chapter 12: Who do we trust? CAs, trust stores and self-signed certificates](https://pkizerotohero.com/handbook/trust-stores/) ## Fix it step by step - [How to trust a private root CA on Linux](https://pkizerotohero.com/guides/add-root-ca-linux/) ## Everything on this topic - [Chains and trust stores](https://pkizerotohero.com/topics/chains-and-trust/)