Unable to use libcurl to access a site requiring client authentication

Using the command line curl, I've got the same error using a .pem file that was also obtained with openssl from a p12 file, The p12 was also able to working properly doing client authentication when imported in a browser. Just like you described, I think.

My problem was caused because the .pem file was not listing the certificates in the proper order: seems that each certificate in the file has to be followed by its issuer certificate. I edited the file and changed the order of the sections and curl was happy.

For the record, my original .p12 file was obtained by backing up a certificate from Firefox.

Also note that in my case, I was not getting prompted for the password and was getting the

curl: (58) unable to set private key file: 'alice.pem' type PEM

before the password prompt

I was facing similar issues, I found out the problem was related to file permissions of the certificate and private key files. The process running PHP did not have read access to those files.

One thing you can try (and that helped me figuring this out) is to run the following code:

$result=openssl_get_privatekey('file://path/to/private/key.pem','password');

and check if the returned value is not false and there are no errors. I was getting:

file_get_contents(/path/to/private/key.pem): failed to open stream: Permission denied

Thanks Hugh for the thread and raugfer for the openssl hint. The later: both helpful and misleading. ;-)

Actually, I solved the problem by making sure that the path of the key file is correct. And here is why the openssl hint was misleading, dispite helping me to check if my PEM file was ok:

cURL needs the complete path, but without 'file://' prefix. While fopen is happy with a relative path, cURL is not. So, all my tests to open the key file had been successful, while cURL was not.

Btw.:

curl_easy_setopt(curl,CURLOPT_SSLCERTPASSWD,"changeit");curl_easy_setopt(curl,CURLOPT_SSLCERTTYPE,"PEM");curl_easy_setopt(curl,CURLOPT_SSLKEYTYPE,"PEM");

are not needed, as the password is only used to decrypt the private key and PEM is the default.