# Osquery Manager does not return results from curl table **URL:** \ **Category:** Kibana\ **Tags:** osquery-manager\ **Created:** [May 18, 2022, 5:44am UTC](https://discuss.elastic.co/t/osquery-manager-does-not-return-results-from-curl-table/305019 "2022-05-18T05:44:42Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![hwang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hwang/32/105817_2.png) [@hwang](https://discuss.elastic.co/u/hwang)\ **Post date:** [May 18, 2022, 5:44am UTC](https://discuss.elastic.co/t/osquery-manager-does-not-return-results-from-curl-table/305019/1 "2022-05-18T05:44:42Z")
Hi Elastic team, Running a query from the curl table returns an empty result. I've confirmed that other queries work and curl\_certificates work as well. `SELECT * FROM curl WHERE url = 'https://www.google.com'` Is there any additional configuration that needs to be enabled for the curl table to work on OSQuery Manager? Version Info: Elasticstack 8.2, OSQuery Manager 1.2.1 Broken curl: ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/2/82011d7160e71475a2a26d7807b9f3fa882987cc.png) Working curl\_certificate: ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/b/7b75b47bbf995f9ac879100b8b5be252faf05034.png) ---
**Author:** ![aleksmaus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aleksmaus/32/56530_2.png) [@aleksmaus](https://discuss.elastic.co/u/aleksmaus)\ **Post date:** [May 18, 2022, 5:52pm UTC](https://discuss.elastic.co/t/osquery-manager-does-not-return-results-from-curl-table/305019/2 "2022-05-18T17:52:14Z")
If you run osquery standalone in interractive mode: ```auto ➜ elastic ./osqueryd -S Using a virtual database. Need help, type '.help' osquery> SELECT * FROM curl WHERE url = 'https://www.google.com'; W0518 13:35:22.938369 228421120 tls.cpp:101] Cannot read TLS server certificate(s): /var/osquery/certs/certs.pem W0518 13:35:23.049543 228421120 curl.cpp:83] Error making request: certificate verify failed +------------------------+--------+------------+---------------+-----------------+-------+--------+ | url | method | user_agent | response_code | round_trip_time | bytes | result | +------------------------+--------+------------+---------------+-----------------+-------+--------+ | https://www.google.com | GET | osquery | | | | | +------------------------+--------+------------+---------------+-----------------+-------+--------+ ``` You will see that it checks the the specific directory for the certs, the example was on Mac OS. Here is the list of default paths defined in osquery for the different platforms: > That error should be in osquerybeat log. The official osquery bundle contains, the certs.pem file, but we do not install it at the moment. We probably should and possibly override this with `--tls_server_certs` option to point to our private install location, need to research. There is the osquery ticket that mentions some potential "side-effect" of using this option: [Cannot fetch HTTPS using curl table when using the `--tls_server_certs` flag for TLS pinning · Issue #6964 · osquery/osquery · GitHub](https://github.com/osquery/osquery/issues/6964), and it looks that the original purpose of this flag might have been different. The short term fix at the moment is to copy the certs.pem from osquery repository [osquery/certs.pem at master · osquery/osquery · GitHub](https://github.com/osquery/osquery/blob/master/tools/deployment/certs.pem) or osquery official distribution package into the default path for the given platform `/var/osquery/certs/certs.pem` for Mac OS, for example. ---
**Author:** ![hwang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hwang/32/105817_2.png) [@hwang](https://discuss.elastic.co/u/hwang)\ **Post date:** [May 19, 2022, 3:14am UTC](https://discuss.elastic.co/t/osquery-manager-does-not-return-results-from-curl-table/305019/3 "2022-05-19T03:14:03Z")
Hi Aleksandr, Thank you for the prompt reply and I believe your diagnosis is correct for HTTPS websites. However, I'm also seeing the save issue for HTTP websites that do not require any TLS certificate configuration. See screenshot below: ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/2/12f7e48bd11fdd1fbe593aa026bcf7ccdc49db84.png) Best, Han ---
**Author:** ![aleksmaus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aleksmaus/32/56530_2.png) [@aleksmaus](https://discuss.elastic.co/u/aleksmaus)\ **Post date:** [May 19, 2022, 12:21pm UTC](https://discuss.elastic.co/t/osquery-manager-does-not-return-results-from-curl-table/305019/4 "2022-05-19T12:21:42Z")
For that particular url you get redirected to HTTPS url ![Screen Shot 2022-05-19 at 8.20.45 AM](https://us1.discourse-cdn.com/elastic/original/3X/5/4/54aeb803626f46cbf0c82b9ee085012477b2808b.png) And then you are back to square one with TLS certs error: ```auto osquery> select * from curl where url='http://ifconfig.me'; W0519 08:18:30.609016 371273216 tls.cpp:101] Cannot read TLS server certificate(s): /var/osquery/certs/certs.pem W0519 08:18:30.714504 371273216 curl.cpp:83] Error making request: certificate verify failed +--------------------+--------+------------+---------------+-----------------+-------+--------+ | url | method | user_agent | response_code | round_trip_time | bytes | result | +--------------------+--------+------------+---------------+-----------------+-------+--------+ | http://ifconfig.me | GET | osquery | | | | | +--------------------+--------+------------+---------------+-----------------+-------+--------+ ``` ---
**Author:** ![hwang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hwang/32/105817_2.png) [@hwang](https://discuss.elastic.co/u/hwang)\ **Post date:** [May 19, 2022, 4:44pm UTC](https://discuss.elastic.co/t/osquery-manager-does-not-return-results-from-curl-table/305019/5 "2022-05-19T16:44:16Z")
Thank you for the clarification and this makes sense. Unfortunately, we won't be able to do a local copy of the certificate folder. Would bundling the official certs.pem be possible at a later Osquery Manager release? ---
**Author:** ![aleksmaus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aleksmaus/32/56530_2.png) [@aleksmaus](https://discuss.elastic.co/u/aleksmaus)\ **Post date:** [May 19, 2022, 4:56pm UTC](https://discuss.elastic.co/t/osquery-manager-does-not-return-results-from-curl-table/305019/6 "2022-05-19T16:56:10Z")
Yes, we are working on bundling the certs file with our solution, hopefully for 8.3 release. ---
**Author:** ![hwang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hwang/32/105817_2.png) [@hwang](https://discuss.elastic.co/u/hwang)\ **Post date:** [May 19, 2022, 5:08pm UTC](https://discuss.elastic.co/t/osquery-manager-does-not-return-results-from-curl-table/305019/7 "2022-05-19T17:08:13Z")
Perfect, thank you! ---
**Author:** ![aleksmaus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aleksmaus/32/56530_2.png) [@aleksmaus](https://discuss.elastic.co/u/aleksmaus)\ **Post date:** [May 19, 2022, 5:28pm UTC](https://discuss.elastic.co/t/osquery-manager-does-not-return-results-from-curl-table/305019/8 "2022-05-19T17:28:33Z")
Thank you for letting us know! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 16, 2022, 5:29pm UTC](https://discuss.elastic.co/t/osquery-manager-does-not-return-results-from-curl-table/305019/9 "2022-06-16T17:29:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.