Cardano-SL node - curl tls certificates

This question has come up a number of times in the telegram, so I will leave this here, for future reference.

The node is running and listening on 8090 (netstat -tlpn | grep cardano-node), but when you try to talk to it using curl, there is an error “Unknown certificate” or “Problem with the SSL CA cert” or similar.

The node was started with certificates. You can see them:

ps auxww | grep cardano-node | grep -v grep
ubuntu    2296 27.1 12.3 1074969864 499000 pts/1 Sl+ 21:28  10:06 /nix/store/19gwyfd12gq3mgnm60wils4w18j9a490-cardano-sl-wallet-new-1.3.1/bin/cardano-node --configuration-file /nix/store/lni5hk603cjnyqrily7gkclwbkx2g0qg-cardano-sl-config/lib/configuration.yaml --configuration-key mainnet_full --tlscert state-wallet-mainnet/tls/server/server.crt --tlskey state-wallet-mainnet/tls/server/server.key --tlsca state-wallet-mainnet/tls/server/ca.crt --log-config /nix/store/lni5hk603cjnyqrily7gkclwbkx2g0qg-cardano-sl-config/log-configs/connect-to-cluster.yaml --topology /nix/store/qslalll5z2cyf7cl9ysiv6by4g6arvfx-topology-mainnet --logs-prefix state-wallet-mainnet/logs --db-path state-wallet-mainnet/db --wallet-db-path state-wallet-mainnet/wallet-db --keyfile state-wallet-mainnet/secret.key --wallet-address localhost:8090 --wallet-doc-address localhost:8091 --ekg-server localhost:8000 --metrics +RTS -N2 -qg -A1m -I0 -T -RTS

You can see the filenames, this bit:

--tlscert state-wallet-mainnet/tls/server/server.crt --tlskey state-wallet-mainnet/tls/server/server.key --tlsca state-wallet-mainnet/tls/server/ca.crt

What you must use, is at the same location, like this:

curl -v --cacert ./cardano-sl/state-wallet-mainnet/tls/server/ca.crt --cert ./cardano-sl/state-wallet-mainnet/tls/client/client.pem https://127.0.0.1:8090/api/v1/wallets

remove the -v to avoid seeing all the output.

2 Likes