Cannot list drives on OneDrive (x509: certificate signed by unknown authority)

What is the problem you are having with rclone?

I'm unable to use rclone to connect to OneDrive without using --no-check-certificate

What is your rclone version (output from rclone version)

rclone v1.52.3
- os/arch: linux/amd64
- go version: go1.14.7

Which OS you are using and how many bits (eg Windows 7, 64 bit)

This is a 64 bit linux remote, head node on a HPC cluster

Which cloud storage system are you using? (eg Google Drive)


The command you were trying to run (eg rclone copy /tmp remote:tmp)

rclone config

The rclone config contents with secrets removed.

type = box
box_sub_type = user
token = {"access_token":"REDACTED","token_type":"bearer","refresh_token":"REDACTED","expiry":"2020-12-08T12:42:43.061340312-06:00"}

A log from the command with the -vv flag

➜ rclone config -vv --dump-bodies
2020/12/21 13:09:45 NOTICE: --dump-bodies is obsolete - please use --dump bodies instead
2020/12/21 13:09:45 DEBUG : rclone: Version "v1.52.3" starting with parameters ["rclone" "config" "-vv" "--dump-bodies"]
2020/12/21 13:09:45 DEBUG : Using config file from "/home/rs22/.config/rclone/rclone.conf"
Current remotes:

Name                 Type
====                 ====
box                  box

e) Edit existing remote
n) New remote
d) Delete remote
r) Rename remote
c) Copy remote
s) Set configuration password
q) Quit config
e/n/d/r/c/s/q> n
name> OneDrive
Type of storage to configure.
Enter a string value. Press Enter for the default ("").
Choose a number from below, or type in your own value
 1 / 1Fichier
   \ "fichier"
 2 / Alias for an existing remote
   \ "alias"
 3 / Amazon Drive
   \ "amazon cloud drive"
 4 / Amazon S3 Compliant Storage Provider (AWS, Alibaba, Ceph, Digital Ocean, Dreamhost, IBM COS, Minio, etc)
   \ "s3"
 5 / Backblaze B2
   \ "b2"
 6 / Box
   \ "box"
 7 / Cache a remote
   \ "cache"
 8 / Citrix Sharefile
   \ "sharefile"
 9 / Dropbox
   \ "dropbox"
10 / Encrypt/Decrypt a remote
   \ "crypt"
11 / FTP Connection
   \ "ftp"
12 / Google Cloud Storage (this is not Google Drive)
   \ "google cloud storage"
13 / Google Drive
   \ "drive"
14 / Google Photos
   \ "google photos"
15 / Hubic
   \ "hubic"
16 / In memory object storage system.
   \ "memory"
17 / Jottacloud
   \ "jottacloud"
18 / Koofr
   \ "koofr"
19 / Local Disk
   \ "local"
20 / Cloud
   \ "mailru"
21 / Mega
   \ "mega"
22 / Microsoft Azure Blob Storage
   \ "azureblob"
23 / Microsoft OneDrive
   \ "onedrive"
24 / OpenDrive
   \ "opendrive"
25 / OpenStack Swift (Rackspace Cloud Files, Memset Memstore, OVH)
   \ "swift"
26 / Pcloud
   \ "pcloud"
27 /
   \ "putio"
28 / QingCloud Object Storage
   \ "qingstor"
29 / SSH/SFTP Connection
   \ "sftp"
30 / Sugarsync
   \ "sugarsync"
31 / Tardigrade Decentralized Cloud Storage
   \ "tardigrade"
32 / Transparently chunk/split large files
   \ "chunker"
33 / Union merges the contents of several upstream fs
   \ "union"
34 / Webdav
   \ "webdav"
35 / Yandex Disk
   \ "yandex"
36 / http Connection
   \ "http"
37 /
   \ "premiumizeme"
38 / seafile
   \ "seafile"
Storage> 23
** See help for onedrive backend at: **

Microsoft App Client Id
Leave blank normally.
Enter a string value. Press Enter for the default ("").
Microsoft App Client Secret
Leave blank normally.
Enter a string value. Press Enter for the default ("").
Edit advanced config? (y/n)
y) Yes
n) No (default)
Remote config
Use auto config?
 * Say Y if not sure
 * Say N if you are working on a remote or headless machine
y) Yes (default)
n) No
y/n> No
y/n> N
For this to work, you will need rclone available on a machine that has
a web browser available.

For more help and alternate methods see:

Execute the following on the machine with the web browser (same rclone
version recommended):

        rclone authorize "onedrive"

Then paste the result below:
result> {"access_token":"REDACTED","expiry":"2020-12-21T14:10:13.129023-06:00"}
2020/12/21 13:10:30 DEBUG : OneDrive: Saved new token in config file
2020/12/21 13:10:30 DEBUG : You have specified to dump information. Please be noted that the Accept-Encoding as shown may not be correct in the request and the response may not show Content-Encoding if the go standard libraries auto gzip encoding was in effect. In this case the body of the request will be gunzipped before showing it.
Choose a number from below, or type in an existing value
 1 / OneDrive Personal or Business
   \ "onedrive"
 2 / Root Sharepoint site
   \ "sharepoint"
 3 / Type in driveID
   \ "driveid"
 4 / Type in SiteID
   \ "siteid"
 5 / Search a Sharepoint site
   \ "search"
Your choice> onedrive
2020/12/21 13:10:40 DEBUG : >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2020/12/21 13:10:40 DEBUG : HTTP REQUEST (req 0xc000274600)
2020/12/21 13:10:40 DEBUG : GET /v1.0/me/drives HTTP/1.1
User-Agent: rclone/v1.52.3
Authorization: XXXX
Accept-Encoding: gzip

2020/12/21 13:10:40 DEBUG : >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2020/12/21 13:10:41 DEBUG : <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
2020/12/21 13:10:41 DEBUG : HTTP RESPONSE (req 0xc000274600)
2020/12/21 13:10:41 DEBUG : Error: x509: certificate signed by unknown authority
2020/12/21 13:10:41 DEBUG : <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
2020/12/21 13:10:41 Failed to query available drives: Get "": x509: certificate signed by unknown authority

Things worked fine with Box, so I don't know what's happening here. I think I tried using --no-check-certificates a while ago and it worked, but I don't want to transfer files in a non-secure manner, especially because I'd need to run rclone cp --no-check-certificate each time. The SSL certs are in the right root location (/etc/pki/tls/certs/ca-bundle.crt), so the advice here is not really useful.

Please let me know what else I can try.

hello and welcome to the forum,

i would make sure to use the latest stable and then test again.

Thank you.

I updated to v1.53.3 just now and still face the same error.

now that the simple stuff is out of the way, we have many experts who should stop by soon...
in the mean time, does this help

The issue seems to be with a different provider, and the OneDrive testing link in that issue seems to have been updated by Microsoft to redirect visitors to a different page.I did try going to the graph [dot] microsoft [dot] com link from the error message (I'm unable to include the link here in my post) on my laptop and got a JSON error. However, it seems to error out on the cluster so it's probably a problem with the SSL certs there. I'll check with my sysadmin.

Thanks to your pointer, I figured out the solution.

I used the FAQ link posted in my question to download a ca-certificates.crt file that I passed to --ca-cert parameter of rclone config. Everything worked fine but now I have to give the --ca-cert every time I use a rclone command. Is there anyway I could add this to the config file as a default, or do I have to use some shell tricks like aliasing to make this simple?

I don't have root privileges, so I cannot save the file in the default location (/etc/ssl/certs/).

i think you can add it to the config file, not 100% sure exactly how to do that.

i would start a new topic with a relevant title.
`how to add a flag like --ca-cert to config file.

That seems like you are missing some CA cert authorities on the install so it's not being trusted.

If you hit that URL, it is just a MS cert:

I'm not familiar with the OS you are describing so not sure if it's dated or something.

It's probably a really old CentOS that needs upgrading. I'll talk to my sysadmin and see if something can be done about it.

@asdffdsa Thanks, I'll search the forum if a topic addressing it exists. If not, I'll create a new topic.

Any way to set non-backend flags/options via file? - #3 by ZeroG

Thank you. It looks like RCLONE_ env variables and aliases are my only options for now. I prefer aliases over environment variables since I can escape them easily (\rclone)

well, it is good to have options.

i see that you just posted there....

good luck

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.