SSL verification error from newly build R82 management

[D_TK]

Hi everyone.  I have a newly built and restored management server, R82 take 91.  I was trying to get the entra id object built, kept failing, no sign of login attempts in azure, so i ran a curl which received the errors show below.  Management is publicly addressed behind an r81.20 gateway, and not using ssl inspection.  Any ideas?

[Expert@R82-Management:0]# curl_cli -v https://www.cisco.com
* Rebuilt URL to: https://www.cisco.com/
* Trying 23.222.206.179...
* TCP_NODELAY set
* Connected to www.cisco.com (23.222.206.179) port 443 (#0)
* ALPN, offering http/1.1
* *** Current date is: Tue May 5 07:49:36 2026
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* err is -1, detail is 2
* *** Current date is: Tue May 5 07:49:36 2026
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* err is -1, detail is 2
* *** Current date is: Tue May 5 07:49:36 2026
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* err is -1, detail is 1
* errdetail=0x1416f086
ERR_lib_error_string: SSL routines
ERR_func_error_string: tls_process_server_certificate
ERR_reason_error_string: certificate verify failed
ERR_error_string: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
* SSL certificate problem: self signed certificate in certificate chain
* Closing connection 0
curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
[Expert@R82-Management:0]#

[Duane_Toler]

You need to include the CA chain in your curl request:

curl_cli --cacert $CPDIR/conf/ca-bundle.crt https://www.cisco.com

[PhoneBoy]

This implies HTTPS Inspection is taking place somewhere between your management and www.cisco.com.
Are you doing this in your environment and if so, is it a Check Point gateway or something else?

[D_TK]

management is behind a r81.20 cluster which has ssl inspection disabled.  when we try to create the entra object, i never see the log in attempt in the entra logs.  not sure if the curl error is a red herring, or an indication of what's causing the entra object creation to fail.