curl-ca-bundle needs update?

[dave@…]

It looks like perhaps gmail is using a new cert and macports' certs haven't been updated yet?

cube:~ dave% openssl s_client -verify -crlf -connect imap.gmail.com:993
verify depth is 0
CONNECTED(00000003)
depth=1 C = US, O = Google Inc, CN = Google Internet Authority
verify error:num=20:unable to get local issuer certificate
verify return:0
140735275196892:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:s3_clnt.c:1166:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 1681 bytes and written 7 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1367385345
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

[dave@…]

rats; forgot the curlies! Sorry.

[cooljeanius (Eric Gallager)]

Livecheck seems to think it's up to date:

gl00b05048:~ egall$ port -v livecheck curl-ca-bundle
curl-ca-bundle seems to be up to date

[dave@…]

If it's up-to-date with upstream, then probably upstream needs an update. Or, I've misdiagnosed the whole thing!

[cooljeanius (Eric Gallager)]

Cc Me!

[matthew-macports@…]

The current location of the Mozilla root certificates is not where the Portfile at browser:trunk/dports/net/curl/Portfile​ is looking. The Portfile is looking at:

​http://mxr.mozilla.org/mozilla/source/security/nss/lib/ckfw/builtins/certdata.txt

but Mozilla now update the file at:

​http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/ckfw/builtins/certdata.txt

(note mozilla-central, rather than mozilla). The former has not changed since December 2012:

​http://bonsai.mozilla.org/cvslog.cgi?file=mozilla/security/nss/lib/ckfw/builtins/certdata.txt&rev=HEAD

the latter was last updated yesterday:

​http://hg.mozilla.org/mozilla-central/log/3de89bd361c3/security/nss/lib/ckfw/builtins/certdata.txt

So it looks like curl-ca-bundle won't have had any updates since 2013 (which explains why I am starting to get SSL cert errors more frequently using curl).

[ryandesign (Ryan Carsten Schmidt)]

Thanks for letting me know about the new locations for these files.

[ryandesign (Ryan Carsten Schmidt)]

r135276

[ryandesign (Ryan Carsten Schmidt)]

Replying to matthew-macports@…:

So it looks like curl-ca-bundle won't have had any updates since 2013 (which explains why I am starting to get SSL cert errors more frequently using curl).

By the way, on recent versions of OS X you can use the certsync port instead of curl-ca-bundle. Then your certificates for curl will be as current as those provided by Apple in your operating system.

[matthew-macports@…]

Thank you :-)