Using the install script with Curl results in a certificate verification failure

[philp]

I'm trying to install on Mac OS X 10.7.4 using the instructions on the example page.

However, I get a certificate verification failure:

error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

Even if I try to suppress Curl's verification using the -k switch, I still ge the same error — I'm guessing because there are subsequent downloads taking place.

I get a message telling me Meteor is installed, but it isn't ;)

[glasser]

That's concerning. I definitely don't see that on Mac OS X 10.8.1.

I wonder how we can get more information out of curl. What is the output of:

$ curl -v https://install.meteor.com/

?

[philp]

Here's what I get. I'm going to have a bit more of a dig around — try to work out what's going on.

$ curl -v https://install.meteor.com/
* About to connect() to install.meteor.com port 443 (#0)
*   Trying 107.22.210.133... connected
* Connected to install.meteor.com (107.22.210.133) port 443 (#0)
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS alert, Server hello (2):
* SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
* Closing connection #0
curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

[philp]

I suspect this is probably to do with something unique to my machine, and the SSL package(s) I have installed. I also have some VPN stuff installed, which could might have an effect on the way certificates are handled.

I've just tried running curl on a couple of other machines in the office, which are running the same version of the OS, and it executed with no errors.

I'd probably put this down to being an edge case which I need to sort out myself. If I do catch the problem, I'll post an update.

[philp]

OK, I found the root of the problem.

I have MAMP installed, and the MAMP-installed version of Curl was taking precedence over the system-wide binary. To fix it, I've changed the PATH in my .profile so that /usr/bin comes before the MAMP path.

I'm guessing this might trip up other users with MAMP installed, as it seems MAMP has made these (silly) changes when it's installed.

That change to .profile may, or may not, have been made manually — I can't properly remember!

[glasser]

Great, thanks for tracking this down! And now we know what to suggest if other users see this.

[xxronis]

Kudos @philp

[theduman]

https://stackoverflow.com/questions/17243032/curl-ca-cert-error-installing-meteor-on-mac/31275888#31275888

if you have ssl certificate issue that solved my problem.Ubuntu 14.04