Failed to load trusted CA certificates despite --check-certificate=false

[sebalos314]

I use aria2 version 1.25.0 on Redhat Linux 6u7 and I can not avoid the big red

01/27 14:09:19 [ERROR] Failed to load trusted CA certificates from /etc/ssl/certs/ca-certificates.crt. Cause: error:02001002:system library:fopen:No such file or directory

despite having the --check-certificate=false parameter on the command line.

Is there anything I am missing ?

[tatsuhiro-t]

I'm not familiar with RedHat, doesn't it have certificates under /etc/ssl/certs? Or another place?

[sebalos314]

Hello Tatsuhiro,
thanks for your reply.

on my system, I have:

# ls /etc/ssl/certs/
ca-bundle.crt  ca-bundle.trust.crt  make-dummy-cert  Makefile  renew-dummy-cert

is that necessary/mandatory to actually have a certificate ?

[tatsuhiro-t]

Somehow aria2 is configured to load /etc/ssl/certs/ca-certificates.crt.
You can pass --ca-certificate option to read CA files from different path.
CA certificates are either /etc/ssl/certs/ca-bundle.crt or /etc/ssl/certs/ca-bundle.trust.crt.

[sebalos314]

thanks, this works with ca-bundle.trust.crt

However, for my understanding, what is the point of option ' --check-certificate=false ' then ?

[tatsuhiro-t]

It just skips server authentication. It does not influence --ca-certificate option.

[sebalos314]

so it is normal that despite specifying check-cerficiate=false, I still have the ERROR message showing ? I was hoping to not use the certificate at all and optionally use it if considered necessary.

[tatsuhiro-t]

The default path to certificates are compile time option. I don't know how your aria2c binary was built, it seems to me that it was not built using correct configuration for RedHat system. To fix this issue cleanly, when building aria2, run ./configure without --with-ca-bundle option, or points it to the correct path.
If rebuilding aria2 is not an option, create aria2 configuration file, and write ca-certificate option to the correct path.

[sebalos314]

thank you. your explanation was correct. I did compile it myself a very long time ago and I did specify --with-ca-bundle='/etc/ssl/certs/ca-certificates.crt' because this was automatically done on my ubuntu system at that time... I am running the binary compiled on the ubuntu system on redhat, which explains all the problems... I will rebuild without the option now and update my findings.

[sebalos314]

I confirm that after recompilation and removing the --with-ca-bundle from configure, the ERROR message is not there anymore.