2

I am using macOS 10.15.7. I have installed wget via homebrew. My goal is to install orpie via opam. opam uses wget. My installation of wget cannot find the certificates it needs. How can I resolve this problem?

The error I am getting is:

$ wget --content-disposition -t 3 -O /Users/jamesh/.opam/default/.opam-switch/sources/csexp.1.5.1/csexp-1.5.1.tbz.part https://github.com/ocaml-dune/csexp/releases/download/1.5.1/csexp-1.5.1.tbz -U opam/2.0.8

--2021-04-28 10:42:18--  https://github.com/ocaml-dune/csexp/releases/download/1.5.1/csexp-1.5.1.tbz
Resolving github.com (github.com)... 140.82.112.3
Connecting to github.com (github.com)|140.82.112.3|:443... connected.
ERROR: cannot verify github.com's certificate, issued by ‘CN=DigiCert High Assurance TLS Hybrid ECC SHA256 2020 CA1,O=DigiCert\\, Inc.,C=US’:
  Unable to locally verify the issuer's authority.
To connect to github.com insecurely, use `--no-check-certificate'.
5
  • Can you show the output of which wget and wget --version? I'm using wget 1.21.1 from homebrew, and wget https://github.com/ocaml-dune/csexp/releases/download/1.5.1/csexp-1.5.1.tbz works fine for me.
    – jimtut
    Commented Apr 28, 2021 at 19:42
  • GNU Wget 1.21.1 built on darwin19.6.0. Commented Apr 28, 2021 at 20:45
  • Can you try the simpler wget example in my 1st comment? I don’t know what the rest of those OPAM things do, so trying to “minimize” the problem. If that simple wget fails, my guess is that you have some kind of proxy/VPN and it’s interfering w. the GH cert.
    – jimtut
    Commented Apr 29, 2021 at 2:44
  • Do you have a .wgetrc or an environment variable pointing to certs? Commented Apr 29, 2021 at 11:43
  • @jimtut I found an answer. There is nothing that is interfering with the cert. In my case, the cert was just not found. Even if I did the simple wget https://github.com/ocaml-dune/csexp/releases/download/1.5.1/csexp-1.5.1.tbz, it would fail. Please see the answer I posted. If you have any comments on it, I would be interested. Commented Apr 29, 2021 at 11:48

4 Answers 4

3

Try1:

 sudo apt install --reinstall ca-certificates

 sudo update-ca-certificates -f

Try2: Create ~/.wgetrc file and add to it:

ca_certificate=/etc/ssl/certs/ca-certificates.crt
1

This is a little too long for a comment, so adding as an "answer", even though the Op's own answer is just fine.

I think the underlying problem is the same as this one: https://stackoverflow.com/questions/56984577/skip-wget-certificate-checking-in-opam

Your macOS version isn't that old (Sep 24, 2020 at the oldest, with several patches even after that), so I wouldn't have thought that your CA bundle would be out of date. But, somehow wget isn't pointing to it.

Fixing it with the Op's proposed Ruby-created default-cert is clever, but shouldn't have been necessary. Homebrew's wget has a dependency on openssl, which comes with a similar cert.pem file, see Where's the ca cert bundle on OSX?. It would be good to know if the Op's homebrew openssl is somehow missing this bundle.

Also see https://stackoverflow.com/questions/24675167/ca-certificates-mac-os-x for other ways to get a cert bundle.

5
  • I do have /usr/local/etc/[email protected]/cert.pem. I do have the folders /System/Library/Keychains/, /Library/Keychains/, ~/Library/Keychains/...but these don't have any .pem files. I assume you are referring to /usr/local/etc/[email protected]/cert.pem Commented Apr 29, 2021 at 16:19
  • I still find it odd that wget does not know how to find these certificates without the .wgetrc, an environment variable, or passing it directly on the command line. Commented Apr 29, 2021 at 17:09
  • Agreed! But, homebrew's wget does work on my Mac without a .wgetrc file. Best guess at this point: the way wget is compiled for my M1 Mac (and installed in /opt/homebrew, not /usr/local) allows wget to pick up the cert bundle it needs, without a .wgetrc file. Would love to hear from other homebrew-based wget users to know for sure, though!
    – jimtut
    Commented Apr 29, 2021 at 18:48
  • Curious...do you know which cert.pem file wget is using on your machine? I started github.com/Homebrew/discussions/discussions/1385 ... perhaps someone knowledgable will see it. Commented Apr 29, 2021 at 20:15
  • No. I tried the strace and other suggestions in my links to see, but I couldn’t see anything like while running wget. Good idea to start that discussion.
    – jimtut
    Commented Apr 29, 2021 at 22:35
1

Just apt-install the ca-certificates package before calling wget.

0

I was able to solve the problem by locating a .pem file that can be used by wget.

I ran:

ruby -ropenssl -e "p OpenSSL::X509::DEFAULT_CERT_FILE"

which returned:

"/private/etc/ssl/cert.pem"

I then created a .wgetrc:

$ cat .wgetrc
ca_certificate=/private/etc/ssl/cert.pem⏎

which allows wget to work.

Additionally, there should be a cert.pem file in the homebrew installed openssl package. Mine was located at /usr/local/etc/[email protected]/cert.pem. Assigning ca_certificate to this path also worked.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .