Using cURL on Mac with Custom Certificate - eMudhra CA Fix

How to use the built-in cURL command line tool on macOS with the custom Mozilla's ca-certificates file

   , ,   3 min read

At the time I wrote this article, there was an incident of a private key compromised by a Certificate Authority, eMudhra. What does that mean for us?

Well, as long as this CA is trusted, anyone can just generate a valid certificate as they wish and can decrypt HTTPS traffic. Meaning they could do a MITM attack without you realizing it.

After the eMudhra incident, most browsers and apps already made an update so this CA is no longer trusted. If you haven’t yet, you should update everything now.

It’s all good except for the built-in curl on macOS.

By default, the system curl on macOS still uses the CA file from the system /etc/ssl/cert.pem. You can check it with this command:

/usr/bin/curl -v https://example.com 2>&1 | grep CAfile

The command output on my Mac was like this:

$ /usr/bin/curl -v https://example.com 2>&1 | grep CAfile
*  CAfile: /etc/ssl/cert.pem

Until this article is published, there is no official update yet from Apple. But you can still protect the system cURL from using the compromised CA and using the latest Certificate store file from Mozilla. Here’s how.

eMudhra Compromised Test

Before we update the cURL CA bundle file, let me show you how to test if your macOS still trusting the compromised eMudhra CA.

If you execute the following command from the terminal and get a 200 HTTP response, that means you’re compromised.

/usr/bin/curl -sSo /dev/null -w 'built-in curl: HTTP %{http_code}\n' https://dv-g3b-emudhra.we-have-a-problem.com

Here’s what it showed on my MacBook:

$ /usr/bin/curl -sSo /dev/null -w 'built-in curl: HTTP %{http_code}\n' https://dv-g3b-emudhra.we-have-a-problem.com
built-in curl: HTTP 200

It shows 200, which means connected successfully, which means my system cURL still trusts eMudhra CA, which means a bad thing and I need to fix it.

In the next section, I’ll show you how to use the macOS system cURL with the latest CA file bundle from Mozilla.

Using curl with a Custom CA Certificates File

Now that I know my macOS cURL still trusts the compromised CA, while waiting for Apple to make an official fix, I will use the latest and safest CA certificate store from Mozilla.

This certificate store can be installed easily using the Homebrew package manager.

brew install ca-certificates

Now we need to make sure that the built-in curl uses this latest certificate store from Mozilla to trust.

To do that, we need to set the CURL_CA_BUNDLE environment variable.

Edit your ~/.zshrc file and add the following line at the top.

export CURL_CA_BUNDLE="$(brew --prefix ca-certificates)/share/ca-certificates/cacert.pem"

This will point curl to use the certificate store defined by CURL_CA_BUNDLE for each terminal session.

Testing curl Connecting to Compromised CA

Now that we have already configured curl using the latest certificate store, we can retry the test.

Start a new terminal session and do the exact same test above.

$ /usr/bin/curl -sSo /dev/null -w 'built-in curl: HTTP %{http_code}\n' https://dv-g3b-emudhra.we-have-a-problem.com
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
Establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
Built-in curl: HTTP 000

This time, I got an ‘SSL certificate problem’ message, which is great news because we’re not supposed to trust this compromised certificate any longer.

Final Thoughts

Anyway, that’s all I can write for today. The world we know is no longer there. Stay vigilant with all these vulnerabilities.

As usual, if you have any questions or a better method, leave a comment below. Thanks for reading, and see you next time!

References