(Hello from 2019!) There is now a
certsync port which keeps the OpenSSL certificates in sync with your system keychain, which can be installed with:
sudo port install certsync
MacPorts should create a launchd startup item to do the sync periodically, but if not,
sudo port load certsync will do that (use
port unload to disable it).
This might be useful, if, for example, your Mac is pre-configured by your employer with a local root CA or other man-in-the-middle certs, or you have your own CAs for other reasons. While not impossible, it would be a pain to
- extract those from your system keychain,
- only to dump them somewhere else on your filesystem (that you're guaranteed to forget about in six months),
- and then, potentially, also having to configure every other command-line utility to point to them (as with the
/opt/local/etc/wgetrc in the other solutions here).
Note that the
certsync port conflicts with
curl-ca-bundle, which is in the dependency chain for many other MacPorts packages, including
curl. If you try to proceed, you'll get warnings like this:
$ sudo port install certsync
Error: Can't install certsync because conflicting ports are active: curl-ca-bundle
Error: Follow https://guide.macports.org/#project.tickets to report a bug.
Error: Processing of port certsync failed
$ sudo port uninstall curl-ca-bundle
Note: It is not recommended to uninstall/deactivate a port that has dependents as
it breaks the dependents.
The following ports will break:
The "broken" ports will probably still work regardless, since
certsync essentially does the job of
curl-ca-bundle by concatenating all your system keychain's CAs into
/opt/local/etc/openssl/cert.pem, but I can't certify that.
Still, if you only care about getting
wget working, and are happy with the built-in
/usr/bin/curl (which is configured to use the macOS system-wide certificate store anyway), simply installing the
certsync port might be the most straightforward solution.
Source: the comments section of Fixing SSL CA certificates with OpenSSL from MacPorts (andatche.com)