-
-
Notifications
You must be signed in to change notification settings - Fork 11.1k
HTTPS downloads from certain sites fail with TLS cert errors #7667
Description
- ran
brew updateand can still reproduce the problem? - ran
brew doctor, fixed all issues and can still reproduce the problem?
There is a (supposed) bug in macOS' built-in cURL, which is used by Homebrew. It makes downloads from certain HTTPS sites fail with this error messages:
curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html
The sites' certificate is actually not expired, and connections with browsers and other cURL builds work perfectly fine. Instead, macOS cURL considers two specific root CA certificates expired despite there being updated certificates using the same keys.
Please see the announcement from the CA and my analysis of the issue on Information Security StackExchange for details.
What you were trying to do (and why)
brew cask reinstall dash
Since this is a cask command, I first reported it to Homebrew-Cask as Homebrew/homebrew-cask#83481. However, @vitorgalvao replied that it should be reported here instead.
That is somewhat warranted, since the issue is indeed broader and may quite likely also affect Formulae. However, I only specifically know of affected Casks at the moment.
What happened (include command output)
==> Downloading https://kapeli.com/downloads/v5/Dash.zip
curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
HTTPS-proxy has similar options --proxy-cacert and --proxy-insecure.
Error: Download failed on Cask 'dash' with message: Download failed: https://kapeli.com/downloads/v5/Dash.zip
What you expected to happen
Successful (re-) installation.
Step-by-step reproduction instructions (by running brew commands)
See above, but take into account that this is only an example of the problems caused by the issue.