curl And dnf Fail TLS Validation Due To Missing CA Trust

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

curl, dnf, or app clients fail with certificate verify errors on HTTPS endpoints.

Environment & Reproduction

Required root/intermediate CA is absent, expired, or not distributed to host trust store.

Root Cause Analysis

Use openssl s_client -connect host:443 -showcerts to inspect presented chain.

Quick Triage

Verify CA files under /etc/pki/ca-trust/source/anchors and trust extract status.

Step-by-Step Diagnosis

Add correct PEM CA file and run update-ca-trust extract.

Solution – Primary Fix

Re-run curl -Iv and dnf makecache to confirm successful TLS validation.

Solution – Alternative Approaches

If TLS inspection proxy exists, deploy enterprise proxy CA chain consistently.

Verification & Acceptance Criteria

Ensure chronyd keeps accurate time because skew can invalidate certificate dates.

Rollback Plan

Confirm security policy is not blocking trust store update paths.

Prevention & Hardening

Package updates, API integrations, and downloads fail across critical workflows.

Related Errors & Cross-Refs

Never disable TLS verification permanently as a workaround in production.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Automate CA lifecycle distribution and expiry monitoring across RHEL 9 systems.