4

when I using this command to pull code:

➜  rt-analysis-multibranch_zhuolian git:(zhuolian) git pull
fatal: unable to access 'https://gitlab.example.com/development/soa-report-analysis.git/': SSL certificate problem: certificate has expired

I am sure the certificate not expired because on other macOS PC I could pull code from the same url. The server side certificate was generate by Let's Encrypt. The macOS Catalina openssl version is:

➜  ~ openssl version
LibreSSL 2.6.5

I tried to using curl, error like this:

➜  rt-analysis-multibranch_zhuolian git:(zhuolian) curl https://gitlab.example.com/development/soa-report-analysis.git
curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.
HTTPS-proxy has similar options --proxy-cacert and --proxy-insecure.

why would this happen? what should I do to fix it? I can access the repo from Google Chrome browser by using the same url.

I finnaly found out that my last time renew the let's encrypt certificate using ISRG Root X1 root certificate by default. the ISRG Root X1 only compatible with macOS 10.12.1. But why the curl command seems to verify the old certificate. why would this happen?

5
  • 1
    Is the actual server (not example.com) using a LetsEncrypt certificate with LE's 'compatibility' chain? Do your curl and git use OpenSSL 1.0.2 or LibreSSL below 3.2.7 or 3.3.5 (I think the latter is more likely on Mac) and do they use a CA-file (aka bundle) that contains the DST X3 root cert (in addition to the ISRG X1 root cert)? If so that's your problem and you need to either change the server's cert chain (if you control it), update to software using a new(er) SSL library, or update or modify the CA file(s?) Oct 14, 2021 at 3:35
  • I pasted all the version info that I could know, I am not sure the server side certificate is LE's 'compatibility' chain or not. @dave_thompson_085 what should I do with my server side certificate?
    – Dolphin
    Oct 14, 2021 at 3:41
  • 1
    If you performed or know about the cert issuance: if certbot was used without specifying a particular chain, it defaults to the 'compatibility' chain, because LE thinks that's a good idea. For anything other than certbot you'd have to give details. If you don't know about the issuance but the server is using PEM format files, look at their contents, they may already identify the subject and issuer, otherwise put each PEM block in a separate file and do openssl x509 -in <onecert -noout -subject -issuer.If they're in some other format you need to give details. ... Oct 15, 2021 at 5:25
  • 1
    ... If you don't have access to the server files or can't decode them, do openssl s_client -connect theserver:443 -servername theserver -showcerts </dev/null and capture the output; it will contain several PEM blocks. Put each other than first in a separate file and continue as above. In either case if the last cert (PEM block) has issuer with CN=DST Root CA X3 that's the compatibility chain. To change it, if using certbot you can renew with --preferred-chain 'ISRG Root X1'. Otherwise depending on the file format you may be able to edit them; give details. ... Oct 15, 2021 at 5:30
  • 1
    ... Alternatively as I said you could remove DST from the client truststore(s). Running curl -v any_https_url will show you what CA-file it is using; you can either modify that, or if it is a system file you can't or don't want to modify, copy it, modify the copy, and use curl --cacert your_fixed_file. However, I don't know if git uses the same as curl or not, so you may need more to fix your real problem. Oct 15, 2021 at 5:33

2 Answers 2

24

See this answer from Ask Different, shamelessly reposted below:

OpenSSL on macOS does not use the system keychain (which makes sense as it's a cross platform library) but rather has its own .pem file containing its root certificates. Even though my systems have a newer version of OpenSSL installed using homebrew and/or MacPorts, the system-wide OpenSSL pem file located at /etc/ssl/cert.pem was out of date and did not include the ISRG Root X1 certificate.

The solution:

  1. Rename /etc/ssl/cert.pem to something else. (I suggest /etc/ssl/cert.pem.org)
  2. Download the latest cacert.pem from https://curl.se/docs/caextract.html
  3. Rename it to cert.pem
  4. Copy it to /etc/ssl/cert.pem

Now curl and any other app using OpenSSL can access websites signed using current Let's Encrypt certificates.

Alternatively, the MacPorts package curl-ca-bundle installs a .pem file containing ISRG Root X1 to /opt/local/etc/openssl/cert.pem which can be used as well.

Other possible solutions:

  • Manually add the ISRG Root X1 certificate to /etc/ssl/cert.pem
  • Configure OpenSSL to use a different .pem file for its root certificates, such as /opt/local/etc/openssl/cert.pem

(Another possible solution is to use curl's -k/--insecure flag.

2
  • How often is this manual process necessary? It seems like in a few years some of my automations are going to break due to newer certificates being needed that my machine again won't have.
    – Michael
    May 14, 2022 at 21:34
  • I just did this, but the error persists.
    – rassoh
    Aug 18, 2022 at 18:22
0

As @rassoh commented (below the accpeted answer), the suggested solution also didn't work for me. After following the steps, curl still complained about an expired certificate. So I used the dtruss utility to show all files opened by curl...

$ sudo dtruss curl https://www.example.com 2>dtruss.out
$ grep open dtruss.out
...
open_nocancel("/usr/local/php5/ssl/openssl.cnf\0", 0x0, 0x1B6)       = 3 0
...
open_nocancel("/Users/babola/.curlrc\0", 0x0, 0x1B6)         = -1 Err#2
...
open("/usr/local/php5/bin/curl\0", 0x8004, 0x6DF212BA)       = 5 0
...
open_nocancel("/usr/local/php5/ssl/cert.pem\0", 0x0, 0x1B6)      = 6 0

Aha! On my particular computer, with my versions of the OS and/or curl, the cert file is in the /usr/local/php5/ssl directory, not in /etc/ssl. Once I copied the cert.pem file to /usr/local/php5/ssl curl stopped complaining about an expired certificate.

1
  • Before anyone chides me for running such an old version of PHP, I do have a newer version...PHP 7.2.21 (cli) (built: Aug 11 2019 20:58:12) ( NTS )...so it would appear that this is specifically a curl problem
    – barush
    Sep 16 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.