How to Fix: Curl NSS error -12190 - Error in TLS handshake

                The primary cause of this error is an incorrect or missing CAfile in the system's SSL/TLS settings. The CAfile specifies the trusted Certificate Authorities (CAs) that are used to verify the authenticity of the server's certificate. Without a valid CAfile, the system cannot establish a secure connection with the server.An alternative reason for this error is an incorrect or missing CApath setting. The CApath specifies the location of the CA certificates. If the CApath is not set correctly, the system may not be able to find the required CA certificates, leading to an error in the TLS handshake process.

            ✅ Best Solutions to Fix It

                Configuring the CAfile and CApath

                    Step 1: Step 1: Verify the existence of the ca-bundle.crt file in the /etc/pki/tls/certs directory. If it does not exist, obtain a copy from a trusted source and copy it to this location.Step 2: Step 2: Update the CAfile setting to point to the newly obtained ca-bundle.crt file. This can be done by editing the /etc/pki/nssdb/nsssyscfg.conf file and updating the 'CAfile' setting to '/etc/pki/tls/certs/ca-bundle.crt'.Step 3: Step 3: Restart the Putty connection or re-run the curl command to test if the error has been resolved.



                Using a different CAfile or CApath

                    Step 1: Step 1: Obtain a copy of the GoDaddy Secure Certificate Authority - G2 CA certificate and update the CAfile setting to point to this file. This can be done by editing the /etc/pki/nssdb/nsssyscfg.conf file and updating the 'CAfile' setting to '/path/to/ca-bundle.crt'.Step 2: Step 2: Restart the Putty connection or re-run the curl command to test if the error has been resolved.


            💡 Conclusion
            To resolve the Curl NSS error -12190, it is essential to configure the system's SSL/TLS settings correctly. By following the steps outlined above, users can ensure that their system is properly configured and able to establish a secure connection with the server. If one method does not work, try another until the issue is resolved.