I'm a web developer and I have a MacBook4,1 with OS X 10.5.8. Important stuff like GitHub, homebrew, ruby and python doesn't work correctly, because curl doesn't work. It seems that the SSL certificates are outdated.

I get this error every time:

curl: (77) error setting certificate verify locations:
  CAfile: /usr/share/curl/curl-ca-bundle.crt
  CApath: none

What can I do to fix this?

  • I wonder why the staff in your local Apple Store won't help you. What exactly was their answer when you brought up the curl problem?
    – nohillside
    Jul 3, 2013 at 19:54
  • I wondered too, because until now I was very satisfied with the apple services. I didn't brought up directly the curl problem. I just asked if there is any way to update my OS to 10.6.
    – sinaneker
    Jul 3, 2013 at 19:57
  • You don't mention where you are coming from but 10.6 is still available in the US Store.
    – nohillside
    Jul 3, 2013 at 20:08
  • I'm from germany and 10.6 isn't available here :(
    – sinaneker
    Jul 3, 2013 at 20:12
  • Feel free to ask a new question on how to get a 10.6 upgrade in Germany. I'll edit this question here to focus on the curl issue.
    – nohillside
    Jul 3, 2013 at 20:15

2 Answers 2


That error doesn't explicitly say that the certificates are outdated does it? It looks to me like it is complaining that the certs are not where they are supposed to be (or potentially they can't be read).

Found this on google:


To summarize the poster suggests either using the -k flag with curl to suppress this error (this is obviously less secure) or make sure that what ever process is calling curl has execute access to all directories on the path to the certificates.


The problem arises because OS X doesn't keep its CA certs in the file system; they live in the "System Roots" keychain. You can see them with the Keychain Access app (found in your Applications/Utilities folder).

For those tools that don't know how to talk to the keychain (like curl), you can export these certs to a folder of your choice, say /etc/ssl/certs to be consistent with most linux distros. You can either drag and drop them out of Keychain Access into a finder window, or select them and choose "Export items..." from the file menu. With drag and drop it always seems to use the binary .cer format, whereas most CLI tools want base64-encoded PEM (commonly using the .crt file extension). You can export in pem format from keychain access, but it only seems to export one cert at a time even if you have multiple certs selected. To work around this, I wrote a bash script to batch convert .cer to PEM format .crt files:

#Convert all .cer files in this folder into PEM format .crt files
shopt -s nullglob
for f in *.cer
        openssl x509 -inform der -in "${f}" -outform pem -out "${f%.*}.crt"
        rm "$f"
chmod 444 *crt

To use it, make a folder, put this script in it (I called it cerconv.sh), drag and drop all your root CA certs into it, open a terminal in that folder and just run bash cerconv.sh.

To avoid nefarious things swapping out your CA certs, I added a line to chmod them all as read-only.

This may all be unnecessary - I certainly have no trouble with git(hub), homebrew, curl etc without having to do this, and have done for years - but at least you now know how to get the certs.

This approach is better than using -k in curl because you're not compromising your security.

Update: I just discovered the security utility on OS X. Here's a command that uses it to to export all certificates from your system keychain into a single .pem file that should be usable with curl:

security export -p -t certs -k `security list-keychains -d system|cut -d '"' -f 2` -o certs/certs.pem
  • This worked for me, just converting my CA cert from cer to pem solved the issue, I just converted it like this: openssl x509 -inform der -in rootCA.cer -outform pem -out rootCA.pem
    – led42
    Jan 22, 2016 at 9:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .