10

So since the Mavericks upgrade curl has more issues with certificates.

When trying to curl a file from my web server with it's self-signed certificate it was getting the error "SSL Certificate: Invalid certificate chain".

This was corrected by adding the certificate to my system keychain and setting it to always allow SSL, information I found here and here.

This works fine and when I curl a file it downloads properly.

However if I run curl with sudo before (e.g I have a script which needs to be run with sudo and does a curl in it) then I'm back to the same error message.

I'm guessing that root doesn't read from the system keychain perhaps?

Does anyone know a way to fix this?

15
+50

f you store your CA certificates on the filesystem (in PEM format) you can tell curl to use them with

sudo curl --cacert /path/to/cacert.pem ...

You can also turn off the certificate verification with

sudo curl --insecure ...

Edit: Updated with regard to feedback

If you want to set this permanently, you should create a .curlrc files and place in your home directory. sudo commands may need this file in /var/root The file takes the same options as the command line but without the dashes. One option per line:

cacert=/path/to/my/certs.pem
  • Thanks for your answer, the script which is being run with sudo is from a third party and so I can't really modify the curl command itself. Insecure isn't really an option. Can this be done globally? – Jacob Tomlinson Feb 28 '14 at 12:18
  • You can make a .curlrc file and store it in your home folder, though using sudo it may need to be /var/root/.curlrc. The file should contain options without dashes, one per line. So " cacert=/path/to/my/certs.pem " – Dan Feb 28 '14 at 12:25
  • 1
    +1 for setting up a root-available .curlrc instead of --insecure. Which is exactly as it says—for an attacker in the network position to do so, it'd be trivial to MITM and inject code. – zigg Feb 28 '14 at 19:33
  • Thanks for this, sounds like what I'm looking for. I'll try it tomorrow and award bounty if it works. – Jacob Tomlinson Mar 5 '14 at 20:01
5

Root doesn't read from the current user trust settings, but there are both an admin trust settings and root-user-specific trust settings. (These are also distinct from the system trust settings.) Note, also, that certificate trust settings are somewhat distinct from just adding a certificate to a keychain; you can mark a cert as trusted without fully adding it. (The exact situation here is not clear to me, and the docs I've seen are vague.)

You can mark a cert as trusted for your current user as

$ security add-trusted-cert /path/to/cert.pem

but that doesn't help with root. The solution, as you might now guess, is either to sudo the above, which then marks it as trusted for the root user specifically:

$ sudo security add-trusted-cert /path/to/cert.pem

or to use the -d flag to add it to the admin trust settings:

$ security add-trusted-cert -d /path/to/cert.pem

(OS X will pop up a password dialog to confirm this one.)

Either of the latter two seems to be sufficient for sudo curl.

Reference: https://developer.apple.com/library/mac/Documentation/Darwin/Reference/ManPages/man1/security.1.html

  • As I said in the question I've added them to the system keychain as well as the login keychain already. – Jacob Tomlinson Mar 5 '14 at 20:02
  • Did you actually try what I suggested? I tested it, in exactly the situation you describe, and it worked. I'm not clear on all the details -- documentation is vague -- but you should know that certificate trust settings are NOT quite synonymous with just adding the cert to a keychain, and that the admin cert trust settings exist separately from both system and user settings/keychains. (There also seems to be a root-user-specific set of user settings in the mix.) I've edited my answer to be clearer on this point. Please, try this solution. – Wes Campaigne Mar 8 '14 at 19:52
  • Yes I tried this solution when you first posted it. The certificates are in the system keychain and set as trusted. Still no luck. – Jacob Tomlinson Mar 10 '14 at 11:24
3

This is really in the output hint:

echo insecure >> ~/.curlrc

Advantage of using above solution is that it works for all curl commands, but it is not recommended since it may introduce MITM attacks by connecting to insecure and untrusted hosts.

2

If you use MacPorts (and the 3rd-party script you mentioned doesn't remove it from $PATH or calls /usr/bin/curl) you can install the certsync and curl ports in this order.

certsync is a tool and a corresponding launchd plist that will export your system keychain to $prefix/etc/openssl/cert.pem and install a symlink $prefix/share/curl/curl-ca-bundle.crt -> $prefix/etc/openssl/cert.pem so MacPorts curl will automatically pick up the certificates. certsync will also automatically update the generated files when you change your system keychain.

  • Thanks for this, I'd like to avoid using MacPorts if possible though. – Jacob Tomlinson Mar 5 '14 at 20:03
0

The documentation you are looking for is here. It explains how to use cURL on Mavericks and how to supply your certificates: http://curl.haxx.se/mail/archive-2013-10/0036.html

-1

To make sudo curl work (on OSX Sierra), we had to import the certificate into the System.keychain and trust it there. This could be done manually in the Keychain app or using this command:

sudo security add-trusted-cert -d -k /Library/Keychains/System.keychain /path/to/cert.pem

It was important to both specify -d and manually set the path to the System keychain via -k to make sure the cert actually gets imported there if it isn't yet.

The command works without sudo, but then would ask for the password via a UI dialog, which might be a hurdle for scripts.

  • I get the error SecCertificateCreateFromData: Unknown format in import. – rraallvv Sep 20 '18 at 13:50
  • Whoever downvoted, please know that I clearly wrote "on OSX Sierra" and this was a working solution for us. If it does not work in newer OSX versions than that might be because OSX support or tooling has changed. Or an issue like the previous commenter, where the input file is not in a supported format (the question doesn't specify that). – Alexander Klimetschek May 6 at 23:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .