I was trying to geocode addresses via Nominatim, using the OpenRefine function “fetch from URL”, but I got empty strings. I re-run it, checking “store error box” and I got the problem: certificate was not recognized or missing. A little confusion: why browser happly donwloaded geocoding rresponses, while OR didn’t?

OR rely on Java funcions to do the job, so I had to fix certificate issue in the following way:

• get certificate:
  $ openssl x509 -in <(openssl s_client -connect nominatim.openstreetmap.org:443 -prexit 2>/dev/null) -out /tmp/nominatim.crt

• store it:
  $ keytool -import -file /tmp/nominatim.crt -keystore cacerts -storepass changeit

• If keytools complains about finding cacert:
  $ find / -name cacerts -print
  /usr/lib/jvm/jdk-8-oracle-arm32-vfp-hflt/jre/lib/security/cacerts
  (in my raspbian Java installation)