信息安全 - 证书适用于 Chrome + Firefox，但不适用于 curl（“无法获取本地颁发者证书”）与最近的 cacert.pem - 吾爱随笔录

我正在尝试连接到防火墙后面的站点，这就是为什么我无法共享 URL 以进行验证。

$ curl -vvvv https://example.com:8080/foo/ba/?wsdl --cacert /tmp/cacert-2018-12-05.pem 
*   Trying a.b.c.d...
* TCP_NODELAY set
* Connected to example.com (a.b.c.d) port 8080 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /tmp/cacert-2018-12-05.pem
  CApath: /etc/ssl/certs
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, Server hello (2):
* SSL certificate problem: unable to get local issuer certificate
* stopped the pause stream!
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

怎么可能？

这是否意味着中间不能正确拉动？但为什么它可以与浏览器一起使用？

链条看起来像这样：

“DigiCert Global Root G2”在我正在使用的 cacert.pem 中。

但不是 Thawte TLS RSA CA G1。