SSL verification error from newly build R82 management

[D_TK]

Hi everyone.  I have a newly built and restored management server, R82 take 91.  I was trying to get the entra id object built, kept failing, no sign of login attempts in azure, so i ran a curl which received the errors show below.  Management is publicly addressed behind an r81.20 gateway, and not using ssl inspection.  Any ideas?

[Expert@R82-Management:0]# curl_cli -v https://www.cisco.com
* Rebuilt URL to: https://www.cisco.com/
* Trying 23.222.206.179...
* TCP_NODELAY set
* Connected to www.cisco.com (23.222.206.179) port 443 (#0)
* ALPN, offering http/1.1
* *** Current date is: Tue May 5 07:49:36 2026
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* err is -1, detail is 2
* *** Current date is: Tue May 5 07:49:36 2026
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* err is -1, detail is 2
* *** Current date is: Tue May 5 07:49:36 2026
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* err is -1, detail is 1
* errdetail=0x1416f086
ERR_lib_error_string: SSL routines
ERR_func_error_string: tls_process_server_certificate
ERR_reason_error_string: certificate verify failed
ERR_error_string: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
* SSL certificate problem: self signed certificate in certificate chain
* Closing connection 0
curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
[Expert@R82-Management:0]#

[Duane_Toler]

You need to include the CA chain in your curl request:

curl_cli --cacert $CPDIR/conf/ca-bundle.crt https://www.cisco.com

[PhoneBoy]

This implies HTTPS Inspection is taking place somewhere between your management and www.cisco.com.
Are you doing this in your environment and if so, is it a Check Point gateway or something else?

[D_TK]

management is behind a r81.20 cluster which has ssl inspection disabled.  when we try to create the entra object, i never see the log in attempt in the entra logs.  not sure if the curl error is a red herring, or an indication of what's causing the entra object creation to fail.

[Duane_Toler]

Yep, the curl test is a red herring for you.  You can add the Entra ID updatable objects to your rules to allow your management server access to those addresses.  You can test with other curl requests, too:

curl_cli --cacert $CPDIR/conf/ca-bundle.crt https://login.microsoftonline.com

curl_cli --cacert $CPDIR/conf/ca-bundle.crt https://sts.windows.net

[D_TK]

Yeah, those curls that explicitly call out the cert store work - thank you..  it's not access rules either, i have management currently allowed to all ms/azure properties, and no drops logged.  i'll have to dig deeper on this one.