Apple SecTrust on second connection fails to get peer certificate

[MonkeybreadSoftware]

I did this

A client connects to an IMAP server with libCURL 8.18.0 in the application on macOS.
The first transfer works, but the second fails with a problem to get peer certificate.

I expected the following

No response

curl/libcurl version

libCURL 8.18.0

operating system

Curent macOS like 15.7.3

[MonkeybreadSoftware]

Okay, so here is the first log:

URL: imaps://mail.xxx.de/INBOX

Host mail.xxx.de:993 was resolved.
IPv6: (none)
IPv4: 82.135.x.x
  Trying 82.135.x.x:993...
TLSv1.3 (OUT), TLS handshake, Client hello (1):
SSL Trust Anchors:
  Native: Apple SecTrust
TLSv1.3 (IN), TLS handshake, Server hello (2):
TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
TLSv1.3 (OUT), TLS handshake, Client hello (1):
TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
TLSv1.3 (IN), TLS handshake, Server hello (2):
TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
TLSv1.3 (IN), TLS handshake, Certificate (11):
TLSv1.3 (IN), TLS handshake, CERT verify (15):
TLSv1.3 (IN), TLS handshake, Finished (20):
TLSv1.3 (OUT), TLS handshake, Finished (20):
SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / secp256r1 / RSASSA-PSS
Server certificate:
  subject: CN=mail.xxx.de
  start date: Aug 15 00:00:00 2025 GMT
  expire date: Aug 15 23:59:59 2026 GMT
  issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=Thawte TLS RSA CA G1
  Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
  Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
  subjectAltName: "mail.xxx.de" matches cert's "mail.xxx.de"
SSL certificate verified via Apple SecTrust.
Established connection to mail.xxx.de (82.135.x.x port 993) from 192.168.9.45 port 65173 
TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* OK Kerio Connect 10.0.8 patch 2 IMAP4rev1 server ready
A001 CAPABILITY
* CAPABILITY IMAP4 IMAP4rev1 IDLE ACL LITERAL+ UIDPLUS QUOTA ID SORT ANNOTATE ANNOTATEMORE STATUS-COUNTERS UNSELECT LISTEXT NAMESPACE XLIST SPECIAL-USE XAPPLEPUSHSERVICE AUTH=CRAM-MD5 AUTH=PLAIN AUTH=LOGIN AUTH=DIGEST-MD5
A001 OK CAPABILITY completed
A002 AUTHENTICATE DIGEST-MD5
+ ...==

A002 OK Authentication successful
A003 SELECT INBOX
* FLAGS (\Deleted \Seen \Answered \Draft \Flagged $MDNSent $Forwarded $AutoJunk $AutoNotJunk $Junk $NotJunk)
* 2 EXISTS
* 0 RECENT
* OK [UIDVALIDITY 1741956943] UID validity
* OK [UIDNEXT 69] Predicted next UID
* OK [PERMANENTFLAGS (\Deleted \Seen \Answered \Draft \Flagged $MDNSent $Forwarded $AutoJunk $AutoNotJunk $Junk $NotJunk)] Permanent flags
A003 OK [READ-WRITE] SELECT completed
A004 FETCH 1:* FLAGS
* 1 FETCH (FLAGS (\Seen $NotJunk))
* 2 FETCH (FLAGS (\Seen $NotJunk))
A004 OK FETCH completed
Connection #0 to host mail.xxx.de:993 left intact

and the second call:

URL: imaps://mail.xxx.de/INBOX;UID=1

Reusing existing imaps: connection with host mail.xxx.de
A005 UID FETCH 1 BODY[]
A005 OK UID FETCH completed
shutting down connection #0
Hostname mail.xxx.de was found in DNS cache
  Trying 82.135.x.x:993...
SSL reusing session with ALPN '-'
TLSv1.3 (OUT), TLS handshake, Client hello (1):
SSL Trust Anchors:
  Native: Apple SecTrust
TLSv1.3 (IN), TLS handshake, Server hello (2):
TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
TLSv1.3 (OUT), TLS handshake, Client hello (1):
TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
TLSv1.3 (IN), TLS handshake, Server hello (2):
TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
TLSv1.3 (IN), TLS handshake, Finished (20):
TLSv1.3 (OUT), TLS handshake, Finished (20):
SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / secp256r1 / UNDEF
Server certificate:
  subject: CN=mail.xxx.de
  start date: Aug 15 00:00:00 2025 GMT
  expire date: Aug 15 23:59:59 2026 GMT
  issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=Thawte TLS RSA CA G1
  subjectAltName: "mail.xxx.de" matches cert's "mail.xxx.de"
SSL: could not get peer certificate
SSL certificate OpenSSL verify result: unable to get local issuer certificate (20)
closing connection #1

As you see the old connection died and it makes a new one. SSL is reused, but later it shows the certificate and reports the error.

Any idea?

[MonkeybreadSoftware]

I got it reproduced on my machine. You need to reuse the CURL connection. Workaround is to make a new one, but maybe still work fixing?

• New CURL session
• set user name
• set password
• set URL "imaps://mail.domain.de/INBOX"
• call Perform
• set URL "imaps://mail.domain.de/INBOX;UID=1"
• call Perform

and the second Perform fails.

Reusing existing imaps: connection with host mail.xxx.de
A005 UID FETCH 1 BODY[]
A005 OK UID FETCH completed
shutting down connection #0
Hostname mail.xxx.de was found in DNS cache
  Trying 82.135.5.132:993...
SSL reusing session with ALPN '-'
TLSv1.3 (OUT), TLS handshake, Client hello (1):
SSL Trust Anchors:
  Native: Apple SecTrust
TLSv1.3 (IN), TLS handshake, Server hello (2):
TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
TLSv1.3 (OUT), TLS handshake, Client hello (1):
TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
TLSv1.3 (IN), TLS handshake, Server hello (2):
TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
TLSv1.3 (IN), TLS handshake, Finished (20):
TLSv1.3 (OUT), TLS handshake, Finished (20):
SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / secp256r1 / UNDEF
Server certificate:
  subject: CN=mail.xxx.de
  start date: Aug 15 00:00:00 2025 GMT
  expire date: Aug 15 23:59:59 2026 GMT
  issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=Thawte TLS RSA CA G1
  subjectAltName: "mail.xxx.de" matches cert's "mail.xxx.de"
SSL: could not get peer certificate
SSL certificate OpenSSL verify result: unable to get local issuer certificate (20)
closing connection #1

Even if I forbid reuse on first connection or do fresh connect option, it still fails.

[icing]

Looks worth fixing.

[icing]

Please try #20446 as a fix for this. The problem arose from session reuse and the mix of OpenSSL and Apple SecTrust.

[MonkeybreadSoftware]

Seems to work. Thank you.