ca-certificates outdated?

[jeroen]

brew gist-logs <formula> link OR brew config AND brew doctor output

brew config
HOMEBREW_VERSION: 4.5.3-24-gfe3783d
ORIGIN: https://github.com/Homebrew/brew
HEAD: fe3783d71170f82d1972a4607a02743bf31b6bbf
Last commit: 22 hours ago
Branch: master
Core tap JSON: 28 May 14:34 UTC
Core cask tap JSON: 28 May 14:34 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_DISPLAY: /private/tmp/com.apple.launchd.TlklotV6uY/org.xquartz:0
HOMEBREW_MAKE_JOBS: 8
HOMEBREW_SORBET_RUNTIME: set
Homebrew Ruby: 3.4.4 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.4.4/bin/ruby
CPU: octa-core 64-bit arm_blizzard_avalanche
Clang: 17.0.0 build 1700
Git: 2.39.5 => /Library/Developer/CommandLineTools/usr/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 15.5-arm64
CLT: 16.3.0.0.1.1742442376
Xcode: N/A
Rosetta 2: false

Verification

• My brew doctor output says Your system is ready to brew. and am still able to reproduce my issue.
• I ran brew update and am still able to reproduce my issue.
• I have resolved all warnings from brew doctor and that did not fix my problem.
• I searched for recent similar issues at https://github.com/Homebrew/homebrew-core/issues?q=is%3Aissue and found no duplicates.

What were you trying to do (and why)?

This URL gives an HTTPS certificate error, but works on all other platforms:

/opt/homebrew/opt/curl/bin/curl https://www2.census.gov
# curl: (60) SSL certificate problem: unable to get local issuer certificate

Even though it works with MacOS native curl (which uses keychain trust store):

/usr/bin/curl https://www2.census.gov
# OK

What happened (include all command output)?

/opt/homebrew/opt/curl/bin/curl https://www2.census.gov
# curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

What did you expect to happen?

curl succeeds

Step-by-step reproduction instructions (by running brew commands)

/opt/homebrew/opt/curl/bin/curl https://www2.census.gov
# curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

[Bo98]

Like much of the world (upstream curl, certifi, some other distros), we base our certificate list from Mozilla. Mozilla recently revoked validity of the AAA Certificate Services root certificate that Cloudflare uses. Cloudflare will need to figure out a solution for this as this problem isn't Homebrew-specific: https://community.cloudflare.com/t/cloudflares-chain-root-ca-removed-from-todays-certifi-update/792978

With that said, we do usually do an extra step to avoid regressions compared to /usr/bin/curl: we merge our certificate list with Apple's root certificate list in the keychain. It seems this step isn't working correctly anymore in recent macOS versions. Though at this point, for the benefit of those not always on the latest macOS with the latest revocations, that's perhaps sometimes a good thing. May need investigating what we actually want here.

[daeho-ro]

• Upgrade from 2025.01.31 to 2025.4.26 broke certificate certifi/python-certifi#349

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.