MacOS – CA storage for cURL on Mavericks

certificatemacos

I was troubleshooting a problem with Arcanist and Phabricator on MacOSX, a cURL/60 error, but it wasn't clear how to check where the php curl libraries were getting their Certificate Authority trust from.

Where or how does Mavericks handle trust storage for Certificate Authorities and self-signed certificates for cURL and/or the curl libraries? Is there a source of documentation on this which I'm missing?

Nb, I'm pretty new with MacOS.

Best Answer

cURL no longer bundles ANY CA certs; so it rejects all SSL certificates as unverifiable.

You'll need to obtain your CA's cert in order for things to work as they should:

  1. Download the cURL cacert.pem file and save it to your server
  2. update php.ini — add curl.cainfo = "PATH_TO/cacert.pem"
  3. Or add the following and/or similar to your cURL options for each instance:
curl_setopt($ch, CURLOPT_CAINFO, "PATH_TO/cacert.pem");   
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);

More information here

Related Question