Previously, I wrote about a temporary fix by making the built-in curl on macOS to use a custom CA bundle after the eMudhra incident.
But curl is not the only tool in my terminal that talks to the internet.
git does too, especially when I push and pull over HTTPS.
It turns out the system git has the same problem.
By default, it still uses the CA file from /etc/ssl/cert.pem, the same file that still trusts the compromised eMudhra CA (by the time I published this article).
In this blog post, I’ll show you how to check which CA file your git uses, how to test it against the compromised CA, and how to point it to the latest Mozilla CA bundle.
git relies on libcurl under the hood for HTTPS connections.
That means we can make git print the same verbose output as curl by setting the GIT_CURL_VERBOSE environment variable.
To see which CA file the system git uses, run this command:
I use ls-remote because it only asks the remote for its references, without cloning anything.
And I use /usr/bin/git to make sure I’m testing the built-in git, not a Homebrew installation.
So, just like curl, the system git is still using the CA file from /etc/ssl/cert.pem.
It was fine most of the time.
But after the eMudhra compromised CA incident, we can never be safe.
Let’s try to do a git ls-remote to a website with the compromised certificate like this:
$ /usr/bin/git ls-remote https://dv-g3b-emudhra.we-have-a-problem.com/
fatal: https://dv-g3b-emudhra.we-have-a-problem.com/info/refs not valid: is this a git repository?
Even though it’s showing a fatal message, it’s still trusting the HTTPS certificate of that website because it doesn’t show an “SSL certificate problem” message.
Which means the macOS system certificate file was still trusting eMudhra CA at the time.
To fix it, let’s point git to use the latest CA file bundle from Mozilla instead.
Using git with a Custom CA Certificates File
Now that I know my macOS git still trusts the compromised CA, while waiting for Apple to make an official fix, I will use the latest and safest CA certificate store from Mozilla.
This certificate store can be installed easily using the Homebrew package manager.
brew install ca-certificates
Now we need to make sure that git uses this latest certificate store from Mozilla to trust.
Unlike curl, which reads the CURL_CA_BUNDLE environment variable, git has its own setting.
So even if you have already set CURL_CA_BUNDLE in your ~/.zshrc, it may not affect git at all, depending on how your git was built.
To do that, we need to set git’s http.sslCAInfo configuration.
This command writes the setting to the global ~/.gitconfig file, so it applies to all repositories for the current user.
Because $(brew --prefix ca-certificates) is executed when you run the command, the final full path is saved in the config file.
That means the macOS git is now using the Mozilla certificate store instead of the built-in macOS CA file bundle.
Next, let’s see if the latest Mozilla CA file has already removed eMudhra from the trusted certificate store.
Testing git by Connecting to a Compromised CA Website
Now that we have already configured git using the latest certificate store, we can try to test it by connecting to a website with eMudhra CA.
Start a new terminal session and do a simple ls-remote test to the test website:
$ /usr/bin/git ls-remote https://dv-g3b-emudhra.we-have-a-problem.com/
fatal: unable to access 'https://dv-g3b-emudhra.we-have-a-problem.com/': SSL certificate problem: unable to get local issuer certificate
This time, I got an ‘SSL certificate problem’ message, which is great news because we’re not supposed to trust this compromised certificate any longer.
Final Thoughts
Anyway, that’s all I can write for today.
The world we know is no longer there.
Stay vigilant with all these vulnerabilities.
As usual, if you have any questions or a better method, leave a comment below.
Thanks for reading, and see you next time!
