I faced exactly with the same error in my own build of libcurl 7.67.0 linked against OpenSSL 1.1.1f built with my own config opts. Every try of making HTTPS connection fails with:
* error setting certificate verify locations:
CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* Closing connection 0
curl: (77) error setting certificate verify locations:
CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
The problem was in no-stdio config opt, passed to ./config of OpenSSL, when i removed it error is gone.
Steps to reproduce (if somebody interested)
Using Ubuntu 16.04.7 LTS (i guess it’s not OS dependent, but i did all tests under 16.04.7), launch the following script to build curl with specified version of OpenSSL:
#!/bin/bash
curdir=$(pwd)
mkdir -p $curdir/depends
mkdir -p $curdir/res
cd $curdir/depends
version=1.1.1f
wget -qO- http://www.openssl.org/source/openssl-$version.tar.gz | tar xzv
cd openssl-$version
export CFLAGS=-fPIC
sed -i.old "s|"engines", "apps", "test"|"engines"|" Configure
./Configure no-shared no-stdio --prefix=${curdir}/res linux-x86_64
make -j1 build_libs libcrypto.pc libssl.pc openssl.pc
make install_sw
cd $curdir/depends
version=7.67.0
wget -qO- https://curl.haxx.se/download/curl-${version}.tar.gz | tar xzv
cd curl-${version}
PKG_CONFIG_LIBDIR="${curdir}/res/lib/pkgconfig" CPPFLAGS="-I${curdir}/res/include" LDFLAGS="-L${curdir}/res/lib" ./configure --prefix=${curdir}/res
make -j$(nproc)
make install
Test binary as:
./res/curl --verbose https://api.telegram.org
You will get something like:
* Trying 149.154.167.220:443...
* TCP_NODELAY set
* Connected to api.telegram.org (149.154.167.220) port 443 (#0)
* ALPN, offering http/1.1
* error setting certificate verify locations:
CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: none
* Closing connection 0
curl: (77) error setting certificate verify locations:
CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: none
Now remove no-stdio config opt from build script and also remove depends and res folders and re-build.
Result will be:
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: none
...
<html>
<head><title>302 Found</title></head>
<body>
<center><h1>302 Found</h1></center>
<hr><center>nginx/1.16.1</center>
</body>
</html>
* Connection #0 to host api.telegram.org left intact
So, no-stdio conf opt of OpenSSL somehow affect on set certificate verify locations. Spent few hours to understand the root of issue.
I am getting the following error using curl:
curl: (77) error setting certificate verify locations: CAfile: /etc/ssl/certs/ca-certificates.crt CApath: none
How do I set this certificate verify locations?
Nimantha
6,6716 gold badges27 silver badges66 bronze badges
asked Jul 1, 2010 at 19:08
3
I also had the newest version of ca-certificates installed but was still getting the error:
curl: (77) error setting certificate verify locations:
CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
The issue was that curl expected the certificate to be at the path /etc/pki/tls/certs/ca-bundle.crt but could not find it because it was at the path /etc/ssl/certs/ca-certificates.crt.
Copying my certificate to the expected destination by running
sudo cp /etc/ssl/certs/ca-certificates.crt /etc/pki/tls/certs/ca-bundle.crt
worked for me. You will need to create folders for the target destination if they do not exist by running
sudo mkdir -p /etc/pki/tls/certs
If needed, modify the above command to make the destination file name match the path expected by curl, i.e. replace /etc/pki/tls/certs/ca-bundle.crt with the path following «CAfile:» in your error message.
answered May 10, 2015 at 18:02
Scott EmmonsScott Emmons
1,8313 gold badges13 silver badges9 bronze badges
3
This error is related to a missing package: ca-certificates. Install it.
In Ubuntu Linux (and similar distro):
# apt-get install ca-certificates
In CygWin via Apt-Cyg
# apt-cyg install ca-certificates
In Arch Linux (Raspberry Pi)
# pacman -S ca-certificates
The documentation tells:
This package includes PEM files of CA certificates to allow SSL-based applications to check for the authenticity of SSL connections.
As seen at: Debian — Details of package ca-certificates in squeeze
Ionică Bizău
106k86 gold badges282 silver badges464 bronze badges
answered Nov 15, 2012 at 15:41
Rubens MariuzzoRubens Mariuzzo
28k27 gold badges120 silver badges148 bronze badges
12
Put this into your .bashrc
# fix CURL certificates path
export CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
(see comment from Robert)
answered Jun 25, 2015 at 20:43
4
Create a file ~/.curlrc with the following content
cacert=/etc/ssl/certs/ca-certificates.crt
as follows
echo "cacert=/etc/ssl/certs/ca-certificates.crt" >> ~/.curlrc
Henke
3,7313 gold badges25 silver badges37 bronze badges
answered Jul 15, 2015 at 8:13
prabeeshprabeesh
9359 silver badges11 bronze badges
4
The quickest way to get around the error is add on the -k option somewhere in your curl request. That option «allows connections to SSL cites without certs.» (from curl —help)
Be aware that this may mean that you’re not talking to the endpoint you think you are, as they are presenting a certificate not signed by a CA you trust.
For example:
$ curl -o /usr/bin/apt-cyg https://raw.github.com/cfg/apt-cyg/master/apt-cyg
gave me the following error response:
curl: (77) error setting certificate verify locations:
CAfile: /usr/ssl/certs/ca-bundle.crt
CApath: none
I added on -k:
curl -o /usr/bin/apt-cyg https://raw.github.com/cfg/apt-cyg/master/apt-cyg -k
and no error message. As a bonus, now I have apt-cyg installed. And ca-certificates.
answered Jun 23, 2013 at 22:32
10gistic10gistic
5153 silver badges13 bronze badges
7
From $ man curl:
--cert-type <type>
(SSL) Tells curl what certificate type the provided certificate
is in. PEM, DER and ENG are recognized types. If not specified,
PEM is assumed.
If this option is used several times, the last one will be used.
--cacert <CA certificate>
(SSL) Tells curl to use the specified certificate file to verify
the peer. The file may contain multiple CA certificates. The
certificate(s) must be in PEM format. Normally curl is built to
use a default file for this, so this option is typically used to
alter that default file.
Mark Fox
8,5739 gold badges53 silver badges74 bronze badges
answered Mar 29, 2012 at 13:03
@roens is correct. This affects all Anaconda users, with below error
curl: (77) error setting certificate verify locations:
CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
The workaround is to use the default system curl and avoid messing with the prepended Anaconda PATH variable. You can either
-
Rename the Anaconda curl binary
mv /path/to/anaconda/bin/curl /path/to/anaconda/bin/curl_anaconda -
OR remove Anaconda curl
conda remove curl
$ which curl
/usr/bin/curl
[0] Anaconda Ubuntu curl Github issue https://github.com/conda/conda-recipes/issues/352
answered Jun 14, 2016 at 6:41
1
If anyone is still having trouble, try this, it worked for me.
Delete the files in your /etc/ssl/certs/ directory
then reinstall ca-certificates:
sudo apt install ca-certificates --reinstall
Did this when I tried installing Linuxbrew.
brian d foy
127k31 gold badges204 silver badges581 bronze badges
answered Nov 24, 2019 at 22:36
2
Another alternative to fix this problem is to disable the certificate validation:
echo insecure >> ~/.curlrc
answered Aug 12, 2015 at 15:31
Pablo R. MierPablo R. Mier
7191 gold badge7 silver badges13 bronze badges
1
For PHP code running on XAMPP on Windows I found I needed to edit php.ini to include the below
[curl]
; A default value for the CURLOPT_CAINFO option. This is required to be an
; absolute path.
curl.cainfo = curl-ca-bundle.crt
and then copy to a file https://curl.haxx.se/ca/cacert.pem and rename to curl-ca-bundle.crt and place it under xampp path (I couldn’t get curl.capath to work). I also found the CAbundle on the cURL site wasn’t enough for the remote site I was connecting to, so used one that is listed with a pre-compiled Windows version of curl 7.47.1 at http://winampplugins.co.uk/curl/
answered Mar 12, 2016 at 10:18
LJTLJT
1,2403 gold badges20 silver badges25 bronze badges
1
I had the exact same problem. As it turns out, my /etc/ssl/certs/ca-certificates.crt file was malformed. The last entry showed something like this:
-----BEGIN CERTIFICATE-----
MIIEDTCCAvWgAwIBAgIJAN..lots of certificate text....AwIBAgIJAN-----END CERTIFICATE-----
After adding a newline before -----END CERTIFICATE-----, curl was able handle the certificates file.
This was very annoying to find out since my update-ca-certificates command did not give me any warning.
This may or may not be a version specific problem of curl, so here is my version, just for completeness:
curl --version
# curl 7.51.0 (x86_64-alpine-linux-musl) libcurl/7.51.0 OpenSSL/1.0.2j zlib/1.2.8 libssh2/1.7.0
# Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
# Features: IPv6 Largefile NTLM NTLM_WB SSL libz TLS-SRP UnixSockets
answered Dec 21, 2016 at 13:51
ShrimpPhaserShrimpPhaser
3,1371 gold badge22 silver badges21 bronze badges
0
This worked for me
sudo apt-get install ca-certificates
then go into the certificates folder at
sudo cd /etc/ssl/certs
then you copy the ca-certificates.crt file into the /etc/pki/tls/certs
sudo cp ca-certificates.crt /etc/pki/tls/certs
if there is no tls/certs folder: create one and change permissions using chmod 777 -R folderNAME
Opal
79.9k27 gold badges184 silver badges203 bronze badges
answered Mar 16, 2015 at 12:52
2
curl performs SSL certificate verification by default, using a «bundle»
of Certificate Authority (CA) public keys (CA certs). The default
bundle is named curl-ca-bundle.crt; you can specify an alternate file
using the —cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you’d like to turn off curl’s verification of the certificate, use
the -k (or --insecure) option.
for example
curl --insecure http://........
answered Oct 8, 2014 at 15:27
medameda
44.9k14 gold badges92 silver badges122 bronze badges
1
It seems your curl points to a non-existing file with CA certs or similar.
For the primary reference on CA certs with curl, see: https://curl.haxx.se/docs/sslcerts.html
answered Jul 1, 2010 at 21:52
Daniel StenbergDaniel Stenberg
51.9k14 gold badges141 silver badges211 bronze badges
Just create the folders, which is missing in your system..
/etc/pki/tls/certs/
and create the file using the following command,
sudo apt-get install ca-certificates
and then copy and paste the certificate to the destination folder, which is showing in your error.. mine was » with message 'error setting certificate verify locations: CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none' in » make sure you paste the file to the exact location mentioned in the error. Use the following command to copy paste..
sudo cp /etc/ssl/certs/ca-certificates.crt
/etc/pki/tls/certs/ca-bundle.crt
Fixed.
answered Mar 18, 2019 at 6:56
Manu R SManu R S
8128 silver badges6 bronze badges
1
I’ve got the same problem : I’m building a alpine based docker image, and when I want to curl to a website of my organisation, this error appears. To solve it, I have to get the CA cert of my company, then, I have to add it to the CA certs of my image.
Get the CA certificate
Use OpenSSL to get the certificates related to the website :
openssl s_client -showcerts -servername my.company.website.org -connect my.company.website.org:443
This will output something like :
CONNECTED(00000005)
depth=2 CN = UbisoftRootCA
verify error:num=19:self signed certificate in certificate chain
...
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
...
Get the last certificate (the content between the -----BEGIN CERTIFICATE----- and the
-----END CERTIFICATE----- markups included) and save it into a file (mycompanyRootCA.crt for example)
Build your image
Then, when you’ll build your docker image from alpine, do the following :
FROM alpine
RUN apk add ca-certificates curl
COPY mycompanyRootCA.crt /usr/local/share/ca-certificates/mycompanyRootCA.crt
RUN update-ca-certificates
Your image will now work properly ! o/
answered Nov 19, 2019 at 10:32
alphayaxalphayax
2,8602 gold badges24 silver badges25 bronze badges
I came across this curl 77 problem while was trying to access elasticsearch running in docker container on Ubuntu 20.04 localhost. Afrer container was started:
-
Check curl without ssl:
curl --cacert http_ca.crt -u elastic https://localhost:9200 -klowercase-kfor insecure connection. -
Check curl configs:
curl-config --configure, noticed what is ca-bundle:--with-ca-bundle=/etc/ssl/certs/ca-certificates.crt. -
Copy http_ca.crt file from container to:
/usr/local/share/ca-certificates/, original command is here. -
Run update on ca-certificates:
sudo update-ca-certificates. -
Run curl:
curl -u elastic:<password> https://localhost:9201.
Finally got response with"tagline" : "You Know, for Search".
Change <password> to the one that was generated when Docker Image was run.
Also notice that on my machine elastic was started on port 9201 (don’t know why: sudo ss -tlpn | grep 9200 gives me nothing), I have found the port with: sudo netstat -ntlp and Programm name was docker-proxy.
answered Jun 7, 2022 at 15:53
dobhareachdobhareach
1683 silver badges6 bronze badges
For what it’s worth, checking which curl is being run is significant too.
A user on a shared machine I maintain had been getting this error. But the cause turned out to be because they’d installed Anaconda (http://continuum.io). Doing so put Anaconda’s binary path before the standard $PATH, and it comes with its own curl binary, which had trouble finding the default certs that were installed on this Ubuntu machine.
answered Dec 10, 2015 at 19:47
roensroens
3312 silver badges9 bronze badges
1
Just find this solution works perfectly for me.
echo 'cacert=/etc/ssl/certs/ca-certificates.crt' > ~/.curlrc
I found this solution from here
answered Apr 17, 2020 at 4:32
DanielDaniel
3353 silver badges9 bronze badges
Run following command in git bash that works fine for me
git config --global http.sslverify "false"
answered Jun 19, 2017 at 18:25
J4cKJ4cK
30.1k8 gold badges42 silver badges54 bronze badges
0
I use MobaXterm which intern uses Cygwin so even after installing ca-certificates using apt-cyg install ca-certificates problem didn’t resolve.
I was still getting the following error:
curl: (77) error setting certificate verify locations: CAfile: /etc/ssl/certs/ca-certificates.crt CApath: none
Then I tried listing the file /etc/ssl/certs/ca-certificates.crt and I couldn’t find it. However I could find /usr/ssl/certs/ca-bundle.crt with all standard CA certificates so I copied the file /usr/ssl/certs/ca-bundle.crt as /etc/ssl/certs/ca-certificates.crt and problem got resolved.
answered May 24, 2021 at 16:26
Website on Plesk shows: cURL error (77): Problem with the SSL CA cert
-
A website or PHP scripts show the following error:
cURL error (77): Problem with the SSL CA cert (path? access rights?)cURL error (77): Problem with the SSL CA cert (path? access rights?)
Error : "error setting certificate verify locations: CAfile: C:ParallelsPleskAdditionalPHPSettingscacert.pem CApath: none"
cURL error 77: error setting certificate verify locations: CAfile: /etc/ssl/certs/cacert.pem CApath: /etc/ssl/certs
-
On Plesk for Windows the Extensions menu may show the following error when trying to open it:
PLESK_ERROR: error setting certificate verify locations: CAfile: C:Program Files (x86)Pleskadminconfcacert.pem CApath: none
Cause
PHP cURL uses an outdated set of root certificates to verify server certificates.
Resolution
Solution 1 – Using Plesk GUI
-
Log in to Plesk.
-
Install
Panel.ini Editorextension: Extensions > Server Tools section > Panel.ini Editor. -
Go to Extensions > My Extensions > Panel.ini Editor (Go To Extension) > Editor.
-
Add records below to the editor and Save changes:
[php]
curlCertificatesUrl="http://curl.haxx.se/ca/cacert.pem"
-
Wait until Daily task is executed (It is executed once a day).
-
Go to Domains > example.com > PHP Settings and add the line below into Additional configuration directives. Replace path to
cacert.pemwith your own path.curl.cainfo="C:Program Files (x86)PleskAdditionalPHPSettingscacert.pem"If it is required to apply the changes for all the domains using a particular PHP version go to Tools & Settings > PHP Settings> %php_version%, click on php.ini tab and add the aforementioned line:
Solution 2 for Windows – Accessing the server
-
Log in to the server via RDP.
-
Download the
cacert.pemfile from the main curl website http://curl.haxx.se/ca/cacert.pem. -
Open
[%plesk_dir%](https://support.plesk.com/hc/en-us/articles/213903325))adminconfpanel.inifile (create it if does not exist)Note: %plesk_dir% by default is C:Program Files (x86)Plesk
-
Add below directive to
panel.ini.[php]
curlCertificatesUrl="http://curl.haxx.se/ca/cacert.pem -
Place downloaded cacert.pem to
[%plesk_dir%](https://support.plesk.com/hc/en-us/articles/213903325)AdditionalPHPSettingsdirectory. -
Wait until Daily task is executed (It is executed once a day).
Solution 2 for Linux – Accessing the server
-
Connect to the server using SSH.
-
Download the CA certificate store from the official cURL website and move it to the directory
/etc/ssl/certs/:# wget https://curl.haxx.se/ca/cacert.pem && mv cacert.pem /etc/ssl/certs/
-
Log into Plesk.
-
Go to Tools & Settings > PHP Settings > select the required PHP version > php.ini.
-
Add the following line into the end of the file:
curl.cainfo="/etc/ssl/certs/cacert.pem"
-
Click OK to save the file
- Server Redundancy
- Linux Containers
- Bare Metal Server
- PhpMyAdmin
- phpPgAdmin
- Oracle VM Server
- Server Virtualization Software
- Windows Server
- Linux
- PHP
- Domain
- Plesk
- Web Server
- DNS Server
- SSL
- SSH
- HTTP
Are you facing a curl error 77 problem with the SSL CA cert while curling an SSL website?
One of the main reasons for this error is broken or missing SSL chain certificate files on the server.
At Bobcares, we help our customers to fix similar SSL errors as part of our Server Management Services.
Today, let’s discuss the details on how to fix this error.
What is curl error 77 problem with the SSL CA cert?
Curl error 77 error is a server-side error. This error indicated that the chain certificate files are missing or “broken”. Usually, this error happens simply by outdated SSL certificate(s) for cURL installed on the server. Also, the wrong or incomplete configuration settings on the server can trigger the error on the website.
The error looks like,
Frequently, some website’s PHP scripts may fail with curl error 77 in Plesk servers. Then the website shows the following error:
cURL error (77): Problem with the SSL CA cert (path? access rights?)cURL error (77): Problem with the SSL CA cert (path? access rights?)This error occurs when PHP cURL uses an outdated set of root certificates to verify server certificates.
How to fix curl error 77 problem with the SSL CA cert
Now, let’s see how our Support Engineers fix the curl error 77 for our customers.
Curling an SSL website can result in an error curl: (77) Problem with the SSL CA cert (path? access rights?)on certain servers.
This error is the result of SSL chain certificate files in the PKI directory being corrupted or missed.
Therefore, we make sure the files /etc/pki/tls/certs/ca-bundle.crt and /etc/pki/tls/certs/ca-bundle.trust.crt exist on the server. If they do not exist, we set up them for our customers.
Sometimes, the error gets resolve by removing and reinstalling the ca certificate.
In a CentOS server, we use the below commands to remove ca-bundle and to install a ca-certificate.
rm -f /etc/ssl/certs/ca-bundle.crt
yum reinstall -y ca-certificates
In Plesk servers, adding the following code to %plesk_dir%adminconfpanel.ini solve the error. By default,
%plesk_dir% is C:Program Files (x86)Plesk
[php]
curlCertificatesUrl="http://curl.haxx.se/ca/cacert.pemInsufficient user permission
Sometimes the curl requests to https:// addresses stop working for cPanel users. However, the root user can still run the curl -I -v https://google.comcommand without any issue.
The problem is due to insufficient permission of the user. The user who is trying to accesscurl -I -v https://google.com doesn’t have enough permission to access /etc/pki directory. This due to the user only has jailed ssh access.
So, our Support Engineers fix the error by granting full access to the user.
Other common SSL certificate problem
Similarly, the error SSL certificate problem: Unable to get local issuer certificate can occur when a self-signed certificate cannot be verified or it shows that the root certificates on the system are not working correctly.
Also, It is important to note that this applies to the system sending the CURL request, and NOT the server receiving the request.
To fix the error,
1. Initially, download cacert.pem. from https://curl.haxx.se/ca/cacert.pem
2. Add the following line to php.ini:
curl.cainfo="/path/to/downloaded/cacert.pem"Furthermore, if the server is shared hosting, add the above value to .user.ini file in the public_html folder.
3. Restart PHP
Now, CURL is able to read HTTPS URL without any error.
[Need assistance to fix curl error 77?- We’re available 24/7.]
Conclusion
In short, the curl error 77 problem with the SSL CA cert occurs when SSL chain certificate files are missing or broken. Today, we saw how our Support Engineers fixed this error.
PREVENT YOUR SERVER FROM CRASHING!
Never again lose customers to poor server speed! Let us help you.
Our server experts will monitor & maintain your server 24/7 so that it remains lightning fast and secure.
GET STARTED
var google_conversion_label = «owonCMyG5nEQ0aD71QM»;
Hossam Elshahawi
Software Engineer , DevOps ❤️ Web
I have faced an issue with a Laravel backend which is trying to make an HTTPS request to another service, and by checking the logs I have found this error.
[2021-05-20 02:16:53] production.ERROR: cURL error 77: error setting certificate verify locations:
CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) {"exception":"[object] (GuzzleHttp\Exception\RequestException(code: 0): cURL error 77: error setting certificate verify locations:
CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) at /www/wwwroot/backend/vendor/guzzlehttp/guzzle/src/Handler/CurlFactory.php:201)
[stacktrace]
I’m using Ubuntu server 20.04.2 LTS with PHP 7.1 installed.
And here you are what I made to solve the issue.
sudo apt-get install ca-certificates
This package includes PEM files of CA certificates to allow SSL-based applications to check for the authenticity of SSL connections.
sudo mkdir -p /etc/pki/tls/certs
This will create folders for the target destination if they do not exist.
sudo cp /etc/ssl/certs/ca-certificates.crt /etc/pki/tls/certs/ca-bundle.crt
Finally, copy certificate to the expected destination.
Post Views:
3,714
Read Next
I am using Ubuntu 14.04. When I use curl, I get the following error:
curl: (77) error setting certificate verify locations: CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath:
From what I gather from googling, the CAfile location it is looking for is not correct for Ubuntu (and it doesn’t exist on my computer), /etc/ssl/certs/ca-certificates.crt is the proper location.
Most of the solutions involved setting the environment variable CURL_CA_BUNDLE to the proper location, or adding cacert=/etc/ssl/certs/ca-certificates.crt to the (newly created) .curlrc file in my home directory. I have tried both, and neither completely solve the issue. curl is finding this location, but it still doesn’t work, giving the error:
curl: (60) SSL certificate problem: self signed certificate in certificate chain
I also tried uninstalling and reinstalling curl in Ubuntu, and updating my CA certs with $ sudo update-ca-certificates --fresh which updated the certs, but still didn’t make error 60 go away.
I am not that knowledgeable about CA certs, and doubt I purposely added some self signed certificate in the past. Perhaps by accident, I don’t know.
Does anyone know how to fix this? Is there a way to actually start fresh with all my certs? Or does anyone even know how I go about figuring out where this self signed certificate is, and then how to remove it?
PS: I don’t want to use the -k (aka —insecure) flag. I want to get this working securely.
The problem arises because OS X doesn’t keep its CA certs in the file system; they live in the «System Roots» keychain. You can see them with the Keychain Access app (found in your Applications/Utilities folder).
For those tools that don’t know how to talk to the keychain (like curl), you can export these certs to a folder of your choice, say /etc/ssl/certs to be consistent with most linux distros. You can either drag and drop them out of Keychain Access into a finder window, or select them and choose «Export items…» from the file menu. With drag and drop it always seems to use the binary .cer format, whereas most CLI tools want base64-encoded PEM (commonly using the .crt file extension). You can export in pem format from keychain access, but it only seems to export one cert at a time even if you have multiple certs selected. To work around this, I wrote a bash script to batch convert .cer to PEM format .crt files:
#!/bin/bash
#Convert all .cer files in this folder into PEM format .crt files
shopt -s nullglob
for f in *.cer
do
openssl x509 -inform der -in "${f}" -outform pem -out "${f%.*}.crt"
rm "$f"
done
chmod 444 *crt
To use it, make a folder, put this script in it (I called it cerconv.sh), drag and drop all your root CA certs into it, open a terminal in that folder and just run bash cerconv.sh.
To avoid nefarious things swapping out your CA certs, I added a line to chmod them all as read-only.
This may all be unnecessary — I certainly have no trouble with git(hub), homebrew, curl etc without having to do this, and have done for years — but at least you now know how to get the certs.
This approach is better than using -k in curl because you’re not compromising your security.
Update: I just discovered the security utility on OS X. Here’s a command that uses it to to export all certificates from your system keychain into a single .pem file that should be usable with curl:
security export -p -t certs -k `security list-keychains -d system|cut -d '"' -f 2` -o certs/certs.pem