This is a repost/update of this question on stackoverflow, which didn't get any attention so I'm trying a more specific stackexchange. My problem was originally that Cargo (Rust's dependency manager) isn't able to download crates because it depends on the native curl, and I think I narrowed the problem down to this certificate bundle issue.
I'm using OS X 10.11.6 (El Capitan), and recently my native curl installation started having issues with its certificate bundle. Specifically, when I try to make an HTTPS connection through Terminal I get untrusted connection error; class=Ssl (16); code=Certificate (-17), and the command curl-config --ca returns a blank line. Trying to configure curl's certificate bundle location doesn't do anything.
From what I understand OSX doesn't really let you mess around with its native curl installation, so I tried just reinstalling the operating system from recovery mode, but no luck.
More recently I found out that Safari is also not trusting some certificates (I usually use Chrome), I guess because it uses the same certificate chain as the native curl, and moreover I can't even connect to the App Store to try to update Safari because UNTRUSTED_CERT_TITLE. This is becoming a huge problem. I checked Keychain Access and it does show a lot of trusted certificates, so I'm not sure what the problem is or how to fix it.
So I guess my question is: how do I fix my native curl installation/certificate bundle?
One thing I've done which does work for some purposes is installing a separate copy of curl through homebrew and then changing my path variable so that it appears before the native one. Then I can make HTTPS connections through curl commands in Terminal, but Safari still doesn't trust certificates that it used to trust (like github), and I still can't connect to the App Store. (And, with regards to my original problem, Cargo is still using the native curl installation so it still can't download crates.)
Update
I managed to resolve my specific issues with Cargo and Git. First I used Safari to manually trust GitHub's certificate, and then Cargo managed to at least download the crates it needed. However, when compiling I still got several "linking errors" and when I tried to use Git I got the error message
xcrun: error: invalid active developer path ...
I fixed this error with xcode-select --reset as suggested here, and now Cargo and Git are working normally again.
However, curl-config --ca still returns a blank line, and I feel like this is still a problem.
