多谢两位的回复，我刚又在另外一台机器上测试了下这个问题。
首先，系统根证书里确实有DigiCert签的证书：
代码： 全选
xx@xx:~$ trust list | grep DigiCert
label: DigiCert Assured ID Root CA
label: DigiCert Assured ID Root G2
label: DigiCert Assured ID Root G3
label: DigiCert Global Root CA
label: DigiCert Global Root G2
label: DigiCert Global Root G3
label: DigiCert High Assurance EV Root CA
label: DigiCert Trusted Root G4
label: DigiCert TLS ECC P384 Root G5
label: DigiCert TLS RSA4096 Root G5
那应该是不需要再导入了。
其次，昨天运行“ curl -v
https://people.redhat.com/rsawhill/rpms ... repomd.xml ”这个命令有问题。我今天又多次运行这个命令，发现有时候可以，有时候不行，很奇怪。
可以时，命令的输出如下：
代码： 全选
* Trying 209.132.178.26...
* TCP_NODELAY set
* Connected to people.redhat.com (209.132.178.26) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, [no content] (0):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
* subject: C=US; ST=North Carolina; L=Raleigh; O=Red Hat, Inc.; CN=people.redhat.com
* start date: Jul 30 00:00:00 2024 GMT
* expire date: Jul 29 23:59:59 2025 GMT
* subjectAltName: host "people.redhat.com" matched cert's "people.redhat.com"
* issuer: C=US; O=DigiCert Inc; CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1
* SSL certificate verify ok.
* TLSv1.3 (OUT), TLS app data, [no content] (0):
> GET /rsawhill/rpms/repodata/repomd.xml HTTP/1.1
> Host: people.redhat.com
> User-Agent: curl/7.61.1
> Accept: */*
...
...
同样的命令，不可以时，输出如下：
代码： 全选
* Trying 209.132.178.26...
* TCP_NODELAY set
* Connected to people.redhat.com (209.132.178.26) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
