2

At work we have Kaspersky installed. Kaspersky installs a self signed cert so it can decrypt/inspect web traffic. Chrome and everything works fine except for homebrew. When i try to install/update software this is what i see:

brew install yarn
==> Downloading https://yarnpkg.com/downloads/1.22.10/yarn-v1.22.10.tar.gz
######################################################################## 100.0%##O#- #
curl: (35) error:1400443E:SSL routines:CONNECT_CR_SRVR_HELLO:tlsv1 alert inappropriate fallback
Error: Failed to download resource "yarn"
Download failed: https://yarnpkg.com/downloads/1.22.10/yarn-v1.22.10.tar.gz

Since it appears its a curl issue i tried to create a .curlrc file with insecure but that doesn't help at all. I'm able to call one of our IT admins over and temporarily turn off web anti-virus but that is starting to be a major pain every time i install/update software. They aren't, of course, going to allow me to permantely turn it off. I have this issue on no matter what mac i use (one is a m1 based mac and the other is an intel based mac).

Improve this question
5
  • Presumably, you need to get curl to trust your enterprises's custom certificate, since it apparently ignores keychain access. Take a look at the cert-related command line switches in curl -h.
    – Wowfunhappy
    Commented Apr 21, 2021 at 1:21
  • Also, I'm pretty sure MacPorts wouldn't have this problem, since it would fall back to its own http mirrors if necessary. (This is safe; like Debian, MacPorts has its own checksum routine.)
    – Wowfunhappy
    Commented Apr 21, 2021 at 1:24
  • @Wowfunhappy this isn't really an enterprise cert. Its the cert installed by Kaspersky but i think your comment applies whether its an enterprise cert or not. With that being said, correct me if i'm wrong, but i don't think i can control how homebrew executes curl? I'd prefer to stick with homebrew if I can but i guess if i have to look at macports then i have to.
    – coding4fun
    Commented Apr 21, 2021 at 1:55
  • I think I'd worry much more about something supposedly performing a man-in-the-middle inspection that tries to force a fallback to TLS v1, than which package manager I was going to use.
    – Marc Wilson
    Commented Apr 21, 2021 at 4:18
  • @MarcWilson i agree with you 100% but theres not much i can do about it.
    – coding4fun
    Commented Apr 23, 2021 at 1:47

2 Answers 2

Reset to default
2

I presume your company is using Kaspersky Endpoint Security.
I would suggest asking your IT admins to add brew update sources to trusted web addresses.
Or perhaps you could ask them for privileges to edit Web Monitor exclusions in your KES client app and add brew to trusted websites yourself, here is an article from the online help: https://support.kaspersky.com/KESMac/11.1_adminguide/en-US/96925.htm

I would also recommend your IT admins to get in touch with Kaspersky Support to resolve this issue.

Improve this answer
0

Disable Kaspersky's Web Threat Protection (see here), do the brew update & brew upgrade, then re-enable protection. It's not a great solution, but worked for me when I had a similar issue with Kaspersky.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .