Greetings,

We are using Pressbooks (latest version) with Prince 11 to export PDFs.

Server config: RHEL 7 Linux; Apache 2.4

We enabled SSL on our server. We can export EPUB, XML, and HTML formats perfectly fine.

However, Pressbooks-Prince PDF exports fail. Prince does not recognize the Certificate issuer.

Error log example:

Array
(
[time] => Wed Jan 25 19:24:16 2017
[user] => browna
[site_url] => https://milnepublishing.geneseo.edu/the-evolution-of-our-tribe-hominini
[blog_id] => 6
[theme] => Pressbooks Custom CSS
[url] => https://milnepublishing.geneseo.edu/the-evolution-of-our-tribe-hominini/format/xhtml?timestamp=1485372255&hashkey=52b776ae15d1355660bb87aab64756b9
)
Wed Jan 25 14:24:16 2017: ---- begin
Wed Jan 25 14:24:16 2017: https://milnepublishing.geneseo.edu/the-evolution-of-our-tribe-hominini/format/xhtml?timestamp=1485372255&hashkey=52b776ae15d1355660bb87aab64756b9: error: Peer's Certificate issuer is not recognized.
Wed Jan 25 14:24:16 2017: https://milnepublishing.geneseo.edu/the-evolution-of-our-tribe-hominini/format/xhtml?timestamp=1485372255&hashkey=52b776ae15d1355660bb87aab64756b9: error: could not load input file
Wed Jan 25 14:24:16 2017: error: failed to load all input documents
Wed Jan 25 14:24:16 2017: finished: failure
Wed Jan 25 14:24:16 2017: ---- end


curl versions:

rpm -qa | grep curl
libcurl-devel-7.29.0-35.el7.x86_64
curl-7.29.0-35.el7.x86_64
python-pycurl-7.19.0-19.el7.x86_64
libcurl-7.29.0-35.el7.x86_64



We are using OpenSSL. I ran a debug openssl s_client -connect milnepublishing.geneseo.edu:443 -debug

and the errors received :

No client certificate CA names sent
Server Temp Key: ECDH, secp521r1, 521 bits
Verify return code: 21 (unable to verify the first certificate)


I can provide the certificate, the CSR, and other information - let me know. Thanks.


Thanks.

Edited 25 Jan 2017 by rootl

If you have a certificate bundle that identifies the remote server you can use the --ssl-cacert option to pass it to Prince, equivalent to the curl --cacert option.

Alternatively you can disable remote certificate verification with the --insecure option.

Got that working. Now how do I configure --ssl-cacert *permanently* ?

Basically when ever we publish a PDF from Pressbooks via Prince, as opposed to running it 'one shot' via command line.

I was told one solution would be to set the environment variable for cURL in Prince itself.. but not sure where the config file is to do this, or if there even is one.

I think you can install it in /usr/share/certificates; please check the documentation specific to your Linux distribution.