Trust the lab CA for one command

The last missing piece is trust. curl rejected our server because lab-ca.crt is not among its trusted roots. There are several ways to fix that, and they differ enormously in blast radius. My advice is to always start with the narrowest one.

The narrowest trust change is command-specific. curl can use the lab root for one transfer without trusting it for every application. The --cacert option replaces curl’s default root store with a file you name, for this command only.

Connect using the explicit root:

curl --cacert lab-ca.crt --resolve app.lab.test:8443:127.0.0.1 https://app.lab.test:8443/
# secure lab

The request should now pass both chain and hostname verification, and you get the server’s response body. Everything the previous lessons built is now working together: the hostname resolves to loopback, the server presents the certificate we issued, and curl walks the chain to the root we explicitly supplied.

Add -v if you want to watch it happen:

curl -v --cacert lab-ca.crt --resolve app.lab.test:8443:127.0.0.1 https://app.lab.test:8443/ 2>&1 | grep -E 'SSL cert|subject|issuer'
#  subject: CN=app.lab.test
#  issuer: CN=Practical TLS Lab CA
# * SSL certificate verify ok.

The SSL certificate verify ok line is the verification result you worked for.

Now break it on purpose, because controlled failure teaches you what each check does. Remove either the CA option or correct hostname to observe a controlled failure. Drop --cacert and you get error 60, unable to get local issuer certificate — the trust check. Keep --cacert but connect to https://127.0.0.1:8443/ and the name check fails instead, because 127.0.0.1 is not in the SAN. Two different protections, two different errors.

Note what we never typed: --insecure. That flag skips verification entirely and teaches you nothing except bad habits. With --cacert every check still runs; we just told curl which root to measure against.

System-wide root installation grants broader authority — every application on the machine would accept anything your lab CA signs. Use it only when the development workflow genuinely requires it and document removal, so the lab root does not outlive the lab.