3

I was troubleshooting a problem with Arcanist and Phabricator on MacOSX, a cURL/60 error, but it wasn't clear how to check where the php curl libraries were getting their Certificate Authority trust from.

Where or how does Mavericks handle trust storage for Certificate Authorities and self-signed certificates for cURL and/or the curl libraries? Is there a source of documentation on this which I'm missing?

Nb, I'm pretty new with MacOS.

Improve this question
1
  • The command line curl has options to specify certificate authorities so you might be able to control things if the system default isn't working for you. What specific PHP curl libraries are you using?
    – bmike ♦
    Commented Jan 7, 2014 at 17:20

4 Answers 4

Reset to default
0

cURL no longer bundles ANY CA certs; so it rejects all SSL certificates as unverifiable.

You'll need to obtain your CA's cert in order for things to work as they should:

  1. Download the cURL cacert.pem file and save it to your server
  2. update php.ini — add curl.cainfo = "PATH_TO/cacert.pem"
  3. Or add the following and/or similar to your cURL options for each instance:
curl_setopt($ch, CURLOPT_CAINFO, "PATH_TO/cacert.pem");   
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);

More information here

Improve this answer
1
  • Compare the output of 'curl thawte.com > /dev/null' and 'curl cacert.org > /dev/null'. cURL might not bundle it, but Apple is bundling some trusts. The php.ini mod seems to be part of the Phabricator instructions, the problem is that even after modifying php.ini and adding curl.cainfo, it still doesn't trust the cert. cURL on Mavericks appears to simply not use the options and may be obtaining the certs elsewhere.
    – mgjk
    Commented Jan 8, 2014 at 10:10
0

I did some experimenting with the "Keychain Access" utility http://en.wikipedia.org/wiki/Keychain_(Apple)#Keychain_Access . It seems that cURL uses the same trust store as Safari, and it is configured there.

I can trust a cert in Safari and it will be trusted in cURL. I can then tell the system not to trust the cert in the Keychain Access utility and cURL will no longer trust it.

Not sure where this is documented, but it works perfectly.

Keychain Access

I guess I'll be doing more reading on how Mavericks works.

Improve this answer
0

For documentation: If you want to read any of the Unix library instructions, you can open the Terminal application. Type "man curl" and you will get the manual for the curl function. There is an app called "iMan" which does a nice job of showing manual pages in a more readable format, and can search for manuals or show variations of similar libraries (https://sourceforge.net/projects/iman-macosx).

Improve this answer
-1

The documentation you are looking for is here. It explains how to use cURL on Mavericks and how to supply your certificates: http://curl.haxx.se/mail/archive-2013-10/0036.html

Improve this answer
1
  • Could you please add the steps in your answer as the URL might die.
    – Rob
    Commented Apr 23, 2014 at 6:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .