How do I fix in curl requests: curl(77) error?

[comcordriro]

Problem

Getting API data from an external service.

Location script: /opt/splunk/etc/apps/statuscake/bin/statuscake.sh

#!/bin/bash
curl https://api.statuscake.com/v1/pagespeed \
  -H "Authorization: Bearer secretkeyhere"

1. When running the curl command directly on Linux host, the output of command is working.
2. When running the script.sh (see above) from the CLI (as splunk user) the output is working.
3. When running the script by Splunk itself, the output shows only in splunkd.log :

09-13-2022 03:21:49.753 +0000 ERROR ExecProcessor [7634 ExecProcessor] - message from "/opt/splunk/etc/apps/statuscake/bin/statuscake_api.sh" \r  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0curl: (77) Problem with the SSL CA cert (path? access rights?)

09-13-2022 03:21:49.649 +0000 ERROR ExecProcessor [7634 ExecProcessor] - message from "/opt/splunk/etc/apps/statuscake/bin/statuscake_api.sh"   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current

09-13-2022 03:20:49.771 +0000 ERROR ExecProcessor [7634 ExecProcessor] - message from "/opt/splunk/etc/apps/statuscake/bin/statuscake_api.sh" \r  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0curl: (77) Problem with the SSL CA cert (path? access rights?)

Tried already (without success)

Updating ca-bundle on CentOS (curl points to right path).

Updated Splunk cert.

Trying to replicate, but curl and the script work without problems as long as they are not being triggered by Splunk.

[bill_kirby]

Thank you for this, I just encountered a similar issue and your post helped me greatly!

[comcordriro · Accepted solution]

Okay i figured out how to get the script working.

Had to add --cacert option to the command. 

#!/bin/bash
curl --cacert /etc/pki/tls/certs/ca-bundle.crt https://api.statuscake.com/v1/pagespeed \
  -H "Authorization: Bearer secretkeyhere"

Apparently when Splunk triggers the script it behaves differently from triggering it manually. Even with same user. When Splunk triggers it, the curl command inside script will use its NSS database (/etc/pki/nssdb). So thats why the --cacert option solves this problem.

I still have no idea whats the deeper logic behind this, but it works this way.