Skip to content

HTTPS downloads from certain sites fail with TLS cert errors #7667

@F30

Description

@F30
  • ran brew update and can still reproduce the problem?
  • ran brew doctor, fixed all issues and can still reproduce the problem?

There is a (supposed) bug in macOS' built-in cURL, which is used by Homebrew. It makes downloads from certain HTTPS sites fail with this error messages:

curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html

The sites' certificate is actually not expired, and connections with browsers and other cURL builds work perfectly fine. Instead, macOS cURL considers two specific root CA certificates expired despite there being updated certificates using the same keys.

Please see the announcement from the CA and my analysis of the issue on Information Security StackExchange for details.

What you were trying to do (and why)

brew cask reinstall dash

Since this is a cask command, I first reported it to Homebrew-Cask as Homebrew/homebrew-cask#83481. However, @vitorgalvao replied that it should be reported here instead.

That is somewhat warranted, since the issue is indeed broader and may quite likely also affect Formulae. However, I only specifically know of affected Casks at the moment.

What happened (include command output)

==> Downloading https://kapeli.com/downloads/v5/Dash.zip

curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.
HTTPS-proxy has similar options --proxy-cacert and --proxy-insecure.
Error: Download failed on Cask 'dash' with message: Download failed: https://kapeli.com/downloads/v5/Dash.zip

What you expected to happen

Successful (re-) installation.

Step-by-step reproduction instructions (by running brew commands)

See above, but take into account that this is only an example of the problems caused by the issue.

Metadata

Metadata

Assignees

No one assigned

    Labels

    outdatedPR was locked due to age

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions