2

I'm on a Macbook with macOS 10.15.5. I have MacPorts, but I am using the 'native' version of curl.

% curl --version
curl 7.64.1 (x86_64-apple-darwin19.0) libcurl/7.64.1 (SecureTransport) LibreSSL/2.8.3 zlib/1.2.11 nghttp2/1.39.2
Release-Date: 2019-03-27
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp smb smbs smtp smtps telnet tftp 
Features: AsynchDNS GSS-API HTTP2 HTTPS-proxy IPv6 Kerberos Largefile libz MultiSSL NTLM NTLM_WB SPNEGO SSL UnixSockets

When I try to d/l the latest youtube-dl, I get a certificate error:

% sudo curl -L https://yt-dl.org/downloads/latest/youtube-dl -o /usr/local/bin/youtube-dl
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

I did take a look at the 'web page mentioned above', but I did not find a solution. The youtube-dl maintainers at GitHub are adamant that their cert is valid and up-to-date. They offered this document as "the answer", but I found nothing useful in it. curl is able to download other SSL webpages without issue, and so I believe the issue is particular to this certificate/website.

I've never had this issue. I have an older Macbook with Mojave - I've updated or re-installed youtube-dl several times without incident, but it also fails now. However, I can run this same curl command on my Ubuntu Linux box, and it works fine. I have to guess this means that both Macs are "missing something" - something that the Mojave Mac once had, but has been removed.

What do I need to do to the Macs to get curl to handle SSL certificates?

6
  • See curl.haxx.se/mail/lib-2020-06/0010.html and related messages. You can use curl -k to disable the certificate check.
    – nohillside
    Jun 6 '20 at 8:23
  • @nohillside: Hello again! :) Yeah - I saw the disable option, but I want to get this configured properly. If that means adding a CA or a cert, I'd prefer to do that. Also want to understand why this happened, how to fix in the future.
    – Seamus
    Jun 6 '20 at 8:34
  • 1
    According to the curl mailing list it's an issue with LibreSSL. Loading new CA/certs didn't work for me. I've installed the homebrewed version of curl now (it's keg-only so you need to adjust your PATH), it doesn't have the issue.
    – nohillside
    Jun 6 '20 at 8:40
  • @nohillside: Please prepare an answer with that info; particularly how to load CA/certs. I guess if it's a bug with LibreSSL, then it will be resolved soon??? I use MacPorts, not homebrew, so that's not going to work for me. And unfortunately, the MacPorts version does have the issue. That's good info - thanks!
    – Seamus
    Jun 6 '20 at 8:53
  • 1
    curl.haxx.se/docs/caextract.html documents how to load CA/certs but as I said it didn't solve the problem for me. So I'm not sure this qualifies as an answer.
    – nohillside
    Jun 6 '20 at 8:58
2

This seems to be an issue with expired certificates and LibreSSl, according to https://curl.haxx.se/mail/lib-2020-06/0010.html. Possible workarounds are

  • Use curl -k at impacted web sites. This disables certificate checking though, so it has some risks
  • (on Catalina) Set CURL_SSL_BACKEND=secure-transport
  • (on all macOS versions) Run brew install curl and set the PATH to pick up the homebrew version with export PATH="/usr/local/opt/curl/bin:$PATH"

PS: You can also try to load new certificates by following the instructions on https://curl.haxx.se/docs/caextract.html but I got the same error even after loading them.

PPS: https://security.stackexchange.com/questions/232445/https-connection-to-specific-sites-fail-with-curl-on-macos has a lot more on this, including alternative solutions like removing the AddTrust certificate from /etc/ssl/cert.pem.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.