0

I am using macOS 10.15.7. I have installed wget via homebrew. My goal is to install orpie via opam. opam uses wget. My installation of wget cannot find the certificates it needs. How can I resolve this problem?

The error I am getting is:

$ wget --content-disposition -t 3 -O /Users/jamesh/.opam/default/.opam-switch/sources/csexp.1.5.1/csexp-1.5.1.tbz.part https://github.com/ocaml-dune/csexp/releases/download/1.5.1/csexp-1.5.1.tbz -U opam/2.0.8

--2021-04-28 10:42:18--  https://github.com/ocaml-dune/csexp/releases/download/1.5.1/csexp-1.5.1.tbz
Resolving github.com (github.com)... 140.82.112.3
Connecting to github.com (github.com)|140.82.112.3|:443... connected.
ERROR: cannot verify github.com's certificate, issued by ‘CN=DigiCert High Assurance TLS Hybrid ECC SHA256 2020 CA1,O=DigiCert\\, Inc.,C=US’:
  Unable to locally verify the issuer's authority.
To connect to github.com insecurely, use `--no-check-certificate'.
5
  • Can you show the output of which wget and wget --version? I'm using wget 1.21.1 from homebrew, and wget https://github.com/ocaml-dune/csexp/releases/download/1.5.1/csexp-1.5.1.tbz works fine for me.
    – jimtut
    Apr 28 '21 at 19:42
  • GNU Wget 1.21.1 built on darwin19.6.0. Apr 28 '21 at 20:45
  • Can you try the simpler wget example in my 1st comment? I don’t know what the rest of those OPAM things do, so trying to “minimize” the problem. If that simple wget fails, my guess is that you have some kind of proxy/VPN and it’s interfering w. the GH cert.
    – jimtut
    Apr 29 '21 at 2:44
  • Do you have a .wgetrc or an environment variable pointing to certs? Apr 29 '21 at 11:43
  • @jimtut I found an answer. There is nothing that is interfering with the cert. In my case, the cert was just not found. Even if I did the simple wget https://github.com/ocaml-dune/csexp/releases/download/1.5.1/csexp-1.5.1.tbz, it would fail. Please see the answer I posted. If you have any comments on it, I would be interested. Apr 29 '21 at 11:48
1

This is a little too long for a comment, so adding as an "answer", even though the Op's own answer is just fine.

I think the underlying problem is the same as this one: https://stackoverflow.com/questions/56984577/skip-wget-certificate-checking-in-opam

Your macOS version isn't that old (Sep 24, 2020 at the oldest, with several patches even after that), so I wouldn't have thought that your CA bundle would be out of date. But, somehow wget isn't pointing to it.

Fixing it with the Op's proposed Ruby-created default-cert is clever, but shouldn't have been necessary. Homebrew's wget has a dependency on openssl, which comes with a similar cert.pem file, see Where's the ca cert bundle on OSX?. It would be good to know if the Op's homebrew openssl is somehow missing this bundle.

Also see https://stackoverflow.com/questions/24675167/ca-certificates-mac-os-x for other ways to get a cert bundle.

5
  • I do have /usr/local/etc/openssl@1.1/cert.pem. I do have the folders /System/Library/Keychains/, /Library/Keychains/, ~/Library/Keychains/...but these don't have any .pem files. I assume you are referring to /usr/local/etc/openssl@1.1/cert.pem Apr 29 '21 at 16:19
  • I still find it odd that wget does not know how to find these certificates without the .wgetrc, an environment variable, or passing it directly on the command line. Apr 29 '21 at 17:09
  • Agreed! But, homebrew's wget does work on my Mac without a .wgetrc file. Best guess at this point: the way wget is compiled for my M1 Mac (and installed in /opt/homebrew, not /usr/local) allows wget to pick up the cert bundle it needs, without a .wgetrc file. Would love to hear from other homebrew-based wget users to know for sure, though!
    – jimtut
    Apr 29 '21 at 18:48
  • Curious...do you know which cert.pem file wget is using on your machine? I started github.com/Homebrew/discussions/discussions/1385 ... perhaps someone knowledgable will see it. Apr 29 '21 at 20:15
  • No. I tried the strace and other suggestions in my links to see, but I couldn’t see anything like while running wget. Good idea to start that discussion.
    – jimtut
    Apr 29 '21 at 22:35
0

I was able to solve the problem by locating a .pem file that can be used by wget.

I ran:

ruby -ropenssl -e "p OpenSSL::X509::DEFAULT_CERT_FILE"

which returned:

"/private/etc/ssl/cert.pem"

I then created a .wgetrc:

$ cat .wgetrc
ca_certificate=/private/etc/ssl/cert.pem⏎

which allows wget to work.

Additionally, there should be a cert.pem file in the homebrew installed openssl package. Mine was located at /usr/local/etc/openssl@1.1/cert.pem. Assigning ca_certificate to this path also worked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.