Issue with curl cmd after enabling the ssl for zap.

[Thoni A]

Hi All,

We are trying to run a curl after enabling the ssl for our zap. 

our instance is loading successfully with https://localhost:8080/UI

we are loading our internal certificate in to zap as a pem file which has both the certificate and unencryted private key.

The certificate is loading successfully and I can confirm from zap.log 

[ZAP-daemon] INFO  org.parosproxy.paros.CommandLine - Root CA certificate loaded from /etc/pki/tls/certs/zap.pem

I downloaded the cert from zap UI which zap is given to me as zap.cer and I added the zap.cer content in CAfile: /etc/pki/tls/certs/ca-bundle.crt

The issue is when running curl cmd "curl -ivs https://localhost:8080/JSON/core/view/version/?apikey=zap"

it is giving the error:

*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 8080 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: invalid CA certificate
* Closing connection 0

 

Can someone assist us in fixing this issue?

[kingthorin+zap]

Looks like you need to add the issuing CA to your hosts crypto setup. That’s an OS issue not a ZAP issue. (Assuming I’m reading things right)

[Thoni A]

Thanks for the reply. With a similar setup, my other application curl cmds works perfectly. If I need to add the CA to my host's crypto setup, where can I add that setup exactly?

[Thoni A]

Could someone please help me solve my issue?

[Simon Bennetts]

Sorry.

We recommend using the one ZAP generates.

Its worth noting that ZAP needs a Root CA certificate. A standard CA certificate will not work.

Cheers,

Simon