{"action":"created","issue":{"url":"https://api.github.com/repos/Homebrew/homebrew-core/issues/1072","repository_url":"https://api.github.com/repos/Homebrew/homebrew-core","labels_url":"https://api.github.com/repos/Homebrew/homebrew-core/issues/1072/labels{/name}","comments_url":"https://api.github.com/repos/Homebrew/homebrew-core/issues/1072/comments","events_url":"https://api.github.com/repos/Homebrew/homebrew-core/issues/1072/events","html_url":"https://github.com/Homebrew/homebrew-core/pull/1072","id":154264045,"number":1072,"title":"*SSL: cert generation tweaks","user":{"login":"DomT4","id":6998367,"avatar_url":"https://avatars.githubusercontent.com/u/6998367?v=3","gravatar_id":"","url":"https://api.github.com/users/DomT4","html_url":"https://github.com/DomT4","followers_url":"https://api.github.com/users/DomT4/followers","following_url":"https://api.github.com/users/DomT4/following{/other_user}","gists_url":"https://api.github.com/users/DomT4/gists{/gist_id}","starred_url":"https://api.github.com/users/DomT4/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DomT4/subscriptions","organizations_url":"https://api.github.com/users/DomT4/orgs","repos_url":"https://api.github.com/users/DomT4/repos","events_url":"https://api.github.com/users/DomT4/events{/privacy}","received_events_url":"https://api.github.com/users/DomT4/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-11T14:54:31Z","updated_at":"2016-05-11T21:59:56Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/Homebrew/homebrew-core/pulls/1072","html_url":"https://github.com/Homebrew/homebrew-core/pull/1072","diff_url":"https://github.com/Homebrew/homebrew-core/pull/1072.diff","patch_url":"https://github.com/Homebrew/homebrew-core/pull/1072.patch"},"body":"- [x] Have you followed the guidelines in our [Contributing](https://github.com/Homebrew/homebrew-core/blob/master/.github/CONTRIBUTING.md) document?\r\n- [x] Have you checked to ensure there aren't other open [Pull Requests](https://github.com/Homebrew/homebrew-core/pulls) for the same formula update/change?\r\n- [x] Have you built your formula locally prior to submission with `brew install <formula>` (where `<formula>` is the name of the formula you're submitting)?\r\n- [x] Does your submission pass `brew audit --strict --online <formula>` (after doing `brew install <formula>`)?\r\n\r\n-----\r\n\r\nDue to the more or less blind trust external tools place in the PEM generated and stored in `/usr/local/etc/openssl` (Presuming your Homebrew is in the normal place) it's possible for self-signed or explicitly not trusted certificates to be treated as perfectly valid and safe.\r\n\r\nThis results in some potentially unexpected differences between system-provided tools and Homebrew-provided tools linked against different crypto libraries.\r\n\r\nBy default both the system curl (Since Mountain Lion) and Homebrew's curl (For ML and above) are linked to Apple's Secure Transport, which handles self-signed certificates in the Keychain as invalid unless they are explicitly trusted and throws the following error on connection: `* SSL certificate problem: Invalid certificate chain`.\r\n\r\nIf you mark the certificate in the Keychain as explicitly trusted both the system and default Homebrew curl respect that and will permit the connection to be established:\r\n\r\n```\r\nConnected to abc.def (xxx.xxx.xxx.xx) port 443 (#0)\r\nTLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\r\nServer certificate: abc.def\r\n...\r\nConnection #0 to host abc.def left intact\r\n```\r\n\r\nThis is also the situation for at least Safari and Google Chrome on OS X, where Keychain trust status guides whether or not the self-signed certificate should be trusted.\r\n\r\nWhere things are potentially more dicey is where you have built Homebrew's curl against OpenSSL or LibreSSL, which is a fairly common configuration, and you have a self-signed certificate in the Keychain when OpenSSL/LibreSSL is installed/upgraded/etc. That self-signed cert is folded into the PEM and treated as perfectly valid, even if it was marked explicitly not trusted in the Keychain at time of PEM creation.\r\n\r\nThis enables self-signed cert connections to go ahead without notification of the potential issue. It's mildly easier to spot on verbose curl connections, but no obvious warning is included that you're using a self-signed certificate for the connection. The example below was explicitly generated as a test cert and tagged as such:\r\n\r\n```\r\n* TLSv1.2 (IN), TLS handshake, Finished (20):\r\n* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384\r\n* ALPN, server did not agree to a protocol\r\n* Server certificate:\r\n*  subject: C=GB; O=TEST.ORG; OU=TESTING; CN=abc.def; emailAddress=test@abc.def\r\n*  start date: May  9 20:28:52 2016 GMT\r\n*  expire date: June  9 20:28:52 2016 GMT\r\n*  common name: abc.def (matched)\r\n*  issuer: C=GB; O=TEST.ORG; OU=TESTING; CN=abc.def; emailAddress=test@abc.def\r\n*  SSL certificate verify ok.\r\n```\r\n\r\nAlthough curl is used for testing here, wget and other utilities that trust OpenSSL's PEM file are impacted as well.\r\n\r\nThis change results in the PEM file only containing system root certificates, which is a more secure default position to take.\r\n\r\nIf you relied on the previous behaviour you can re-enable it by copying PEM files into `/usr/local/etc/openssl/certs` & running `$(brew --prefix openssl)/bin/c_rehash`. You may need to pass the directory to specific tools or by setting the SSL_CERT_DIR variable.\r\n\r\nCredit to Geoff Nixon for the original report. Extra testing done by me against an Ubuntu server running the latest nginx release."},"comment":{"url":"https://api.github.com/repos/Homebrew/homebrew-core/issues/comments/218603205","html_url":"https://github.com/Homebrew/homebrew-core/pull/1072#issuecomment-218603205","issue_url":"https://api.github.com/repos/Homebrew/homebrew-core/issues/1072","id":218603205,"user":{"login":"DomT4","id":6998367,"avatar_url":"https://avatars.githubusercontent.com/u/6998367?v=3","gravatar_id":"","url":"https://api.github.com/users/DomT4","html_url":"https://github.com/DomT4","followers_url":"https://api.github.com/users/DomT4/followers","following_url":"https://api.github.com/users/DomT4/following{/other_user}","gists_url":"https://api.github.com/users/DomT4/gists{/gist_id}","starred_url":"https://api.github.com/users/DomT4/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DomT4/subscriptions","organizations_url":"https://api.github.com/users/DomT4/orgs","repos_url":"https://api.github.com/users/DomT4/repos","events_url":"https://api.github.com/users/DomT4/events{/privacy}","received_events_url":"https://api.github.com/users/DomT4/received_events","type":"User","site_admin":false},"created_at":"2016-05-11T21:59:56Z","updated_at":"2016-05-11T21:59:56Z","body":"For some reason the `openssl` bottles aren't generating correctly anymore, hmm. There should be an `etc` directory in `.bottle` and neither exist. This isn't a problem on the from source build, so it's an exclusively bottling issue apparently."}}