[error] SSL: :certify: ssl_alert.erl:88:Fatal error: unknown ca

[mconigliaro]

We're seeing this error with HTTPoison 0.13.0 when we don't set the cacertfile option in API calls. The following seems to fix it:

HTTPoison.get("https://example.com/", [], ssl: [cacertfile: "/etc/ssl/certs/ca-certificates.crt"])

What we don't understand is that this used to work for us without the cacertfile option. What location does HTTPoison use when the cacertfile isn't set? Is there some global Erlang option it falls back to?

[mconigliaro]

This looks related to #62 and #119. They discovered the same workaround we did (use the cacertfile parameter), but I'd still love to know how this ever worked for us, and what made it stop.

[mconigliaro]

Unless I'm missing something (I'm pretty new to Elixir), it looks like HTTPoison relies on hackney, which gets its default CA certificates from certifi (certifi/erlang-certifi#21).

[mconigliaro]

We gave up and just started using the cacertfile option.