-
-
Notifications
You must be signed in to change notification settings - Fork 6.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
my curl 7.75.0 can't read a cert from my keychain #6717
Comments
To use --cert in the way you describe requires using the SecureTransport SSL backend. Your libcurl from brew is built with multiple SSL backends, and (likely) the default backend is set to OpenSSL.
What you can do is choose the secure transport backend explicitly by setting it in the environment. I think this should work:
|
|
Ref: curl#2209 (comment) Ref: curl#6717 (comment) Closes #xxxx
- Document the names that can be used with CURL_SSL_BACKEND: bearssl, gnutls, gskit, mbedtls, mesalink, nss, openssl, rustls, schannel, secure-transport, wolfssl Ref: curl#2209 (comment) Ref: curl#6717 (comment) Closes #xxxx
CURL_SSL_BACKEND is an environment variable that is used to override the default SSL backend set at build time. It is documented in the libcurl and curl tool sections on environment variables. It is not meant for your curlrc. It is only useful if you built curl for multiple SSL backends ("MultiSSL" feature). https://curl.se/docs/manpage.html#CURLSSLBACKEND I've proposed PR #6755 to add the SSL backend names: |
- Document the names that can be used with CURL_SSL_BACKEND: bearssl, gnutls, gskit, mbedtls, mesalink, nss, openssl, rustls, schannel, secure-transport, wolfssl Ref: #2209 (comment) Ref: #6717 (comment) Closes #6755
I did this
curl https://webapp.at.my.company --cert $USER
where there's a cert with the value of $USER in the OS X keychain.curl: (58) could not load PEM client certificate, OpenSSL error error:02001002:system library:fopen:No such file or directory, (no key found, wrong pass phrase, or wrong file format?)
/usr/local/Cellar/curl/7.72.0/bin/curl https://webapp.at.my.company --cert $USER
and it performed as expectedI expected the following
the webapp response
curl/libcurl version
doesn't work
vs
works
operating system
Darwin {machine} 19.6.0 Darwin Kernel Version 19.6.0: Tue Jan 12 22:13:05 PST 2021; root:xnu-6153.141.16~1/RELEASE_X86_64 x86_64
NB
I'm not at all sure that this is a curl issue, as opposed to "how brew is compiling curl" issue. But I've googled around for other people having the issue, details on how curl talks to the OS X keychain, and not found a lot.
This is not urgent for me, I still have 7.72.0, but I think it would eventually be insecure for me to never upgrade.
Thank you very much. Be well.
The text was updated successfully, but these errors were encountered: