18

I am trying to install NetLogo via Homebrew Cask. I run the following command:

brew cask install netlogo

Homebrew starts the download but immediately throws the following error:

==> Downloading https://ccl.northwestern.edu/netlogo/6.1.1/NetLogo-6.1.1.dmg
#=#=-#  #                                                                     
curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
Error: Download failed on Cask 'netlogo' with message: Download failed: https://ccl.northwestern.edu/netlogo/6.1.1/NetLogo-6.1.1.dmg

I am understanding that it is happening due to expired certificate on the website hosting NetLogo installer.

Is there a way to work around this issue? For example is there an argument that could be passed to brew command to make it ignore the error? or provide a resolution? or can I manually download the DMG and place it in the Homebrew cache directory so that Homebrew skips downloading when running the install command?

3 Answers 3

28

This is documented here, see also https://curl.haxx.se/mail/lib-2020-06/0010.html and https://security.stackexchange.com/questions/232445/https-connection-to-specific-sites-fail-with-curl-on-macos.

The proposed solution is to set HOMEBREW_FORCE_BREWED_CURL

HOMEBREW_FORCE_BREWED_CURL=1 brew cask install netlogo

If you run Catalina you can use

export CURL_SSL_BACKEND=secure-transport

to have curl not use LibreSSL (which seems to have the issue).

You can also remove the entry for AddTrust from /etc/ssl/cert.pem (it's the first entry in the file, just remove all which expired end of May 2020).

5
  • Really appreciate your helpful pointer and explanation. I realize I have not carefully browsed through the Homebrew community discussion forums.
    – Nimesh Neema
    Commented Jun 10, 2020 at 12:28
  • @Seamus You might be interested in this as well :-)
    – nohillside
    Commented Jun 10, 2020 at 12:28
  • 1
    HOMEBREW_FORCE_BREWED_CURL=1 worked for me. CURL_SSL_BACKEND=secure-transport did not. I did not try editing cert.pem
    – Noach
    Commented Jun 29, 2020 at 14:50
  • There needs to be semicolon between your two commands. Basically the answer is, first HOMEBREW_FORCE_BREWED_CURL=1, and then try your install whatever it is.
    – matt
    Commented Jul 10, 2022 at 23:50
  • @matt There doesn’t need to be (otherwise there would also need to be an export in front. ENV=var cmd is valid shell syntax for setting ENV only for cmd (see Simple commands in man bash, "A simple command is a sequence of optional variable assignments followed by blank-separated words and redirections").
    – nohillside
    Commented Jul 11, 2022 at 5:19
10

For people that don't have a brewed installed curl, the accepted answer is not sufficient because it's impossible to install the homebrew curl with invalid certificates (since brew install uses the system curl when the homebrew curl is not available). One way to get around this is to pass the --insecure flag to the system curl when installing the homebrew curl, through the ~/.curlrc file. However, one needs to define the HOMEBREW_CURLRC=1 environment variable prior to this:

edit or create ~/.curlrc file and add "--insecure" to it then:
$ HOMEBREW_CURLRC=1 brew install curl
delete ~/.curlrc file or remove the "--insecure" from it
$ [HOMEBREW_FORCE_BREWED_CURL=1 if needed] brew install whatever

Source

2
  • I am a bit confused by this sitiuation. Your steps helped in my situation. Additionally I added # Fix broken macOS curl if [ -d "/usr/local/opt/curl/bin" ] ; then export PATH="/usr/local/opt/curl/bin:$PATH"; fi; export HOMEBREW_FORCE_BREWED_CURL=1 to my ~/.bash_profile. I am still on mojave. Will see if this issue gets solved when I finally upgrade to a more recent MacOS.
    – Pete
    Commented Oct 4, 2021 at 9:14
  • thanks this works! Commented Aug 26, 2023 at 19:01
2

When I access the URL from here, the SSL certificate is not expired. I would suggest to retry the command now to see if it works.

If you still get the same error, I would check the date & time settings on your computer - they might be incorrect.

If they're correct, I would suggest manually installing the program. The Cask code for this specific app is very simple, so you can easily do it manually.

Simply open this URL in a browser:

https://ccl.northwestern.edu/netlogo/6.1.1/

Download the DMG file for macOS. Double-click the DMG to open it, and install like any other application.

UPDATE: Given the comment below that the question was not asked for the purpose of getting NetLogo installed, but rather to understand why the problem occurs and how to resolve it properly:

When you look closer at the TLS communication with the download server (ccl.northwestern.edu), we see that the problem is actually with the bundled intermediate certificates. I.e. the actual certificate for ccl.northwestern.edu is OK and not expired, however the server replies with a number of intermediates and CA certificates that are expired (in particular the "USERTrust RSA Certification Authority" and "AddTrust Extdernal CA Root" certificates).

When you access the site in Safari, you do not get an error, as it uses macOS' built-in certificate store. In Keychain you can validate that macOS by default has an up to date and non-expired CA certificate for "USERTrust RSA Certification Authority". Therefore you do not get any errors here.

However when you use brew-cask, the file is downloaded using curl - and curl does not access the same trust store. If you try to download the file manually on the command line using curl -O you'll get the same error.

The client-side fix for the curl command line is to set CURL_CA_BUNDLE environment to point to a text file that has the updated intermediates. I've tested that and you can then download without warnings.

However brew-cask does not seem to relay that environment variable on to curl, nor does it seem to respect a cacert line in ~/.curlrc.

The optimal way to resolve this problem is to fix the server. Update the intermediate certificate bundle associated with the web site on the server, and the problem will go away.

2
  • I do not see the SSL certificate expired too. It's the Homebrew command that's reporting the problem. The data & time are set to automatic and are correct. I am able to download the DMG and can manually install the program, however I am looking to identify and resolve the error thrown by Homebrew.
    – Nimesh Neema
    Commented Jun 10, 2020 at 9:23
  • Thank you for the informative post. I think it would make a good exercise to get it resolved from the server end by reporting to the concerned.
    – Nimesh Neema
    Commented Jun 10, 2020 at 12:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .