Why can't curl trust DDEV projects/domains on macOS? - macos

Question

When setting up a TYPO3 project with ddev on macos 12.6.2, the curl command cannot access the DDEV project but doesn't trust the certificate:
> curl -X OPTIONS 'https://typo3.ddev.site/jsonapi'
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.`
However, using the same command with ddev exec curl https://typo3.ddev.site/jsonapi returns a proper result:
> ddev ssh
[user]#typo3-web:/var/www/html$ curl -X OPTIONS 'https://typo3.ddev.site/jsonapi'
{
"meta": {
"prefix": "ai",
"content-baseurl": "/uploads/tx_aimeos"
, "locale": {[...]}
, "resources": {[...]}
}
}
[user]#typo3-web:/var/www/html$
PS: My setup uses a TYPO3 extension called Aimeos, which offers a jsonapi. With Aimeos, it is required to initially get all the resources via the OPTIONS method, which returns a json.

Answer 1

tl;dr
In my case the solution was:
# Make sure to use brew's curl:
> brew install curl
> echo 'export PATH="/opt/homebrew/opt/libressl/bin:$PATH"' >> ~/.zshrc
# Restart terminal.
> brew install ca-certificates
# or, if already installed:
> brew reinstall ca-certificates
> mkcert -uninstall
> mkcert -install
> ddev poweroff
# Remove the `mkert_caroot` from `~/.ddev/global_config.yaml`
> mkcert -uninstall && sudo chmod -R ugo+w "$(mkcert -CAROOT)" && rm -rf "$(mkcert -CAROOT)" && mkcert -install
# Reboot the computer.
> ddev start
Explanation:
Upon comparing the outputs of
> ddev exec curl -v 'https://api.typo3.ddev.site'
(which is pure Linux) and macos's
> curl -v 'https://api.typo3.ddev.site'
(which has to be the homebrew version!), it became clear that in my case curl could not see the ca-certificates:
# This output is shown only with the ddev curl command:
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: /etc/ssl/certs
Randy Fay (from ddev) recommended to take the following steps:
> brew install ca-certificates
# or, if already installed:
> brew reinstall ca-certificates
# These steps might not be necessary, but just to be sure:
> mkcert -uninstall
> mkcert -install
> ddev poweroff
> ddev start
In my case this resulted in a working homebrew curl that can access ddev domains. Thank you, Randy!
Further things to consider
For the sake of completeness I should mention that there were many other steps taken before this one. Here is a collection of what I can remember:
# Check if the proper homebrew architecture is installed (important in times of M1, Rosetta and Intel):
arch && ls -l $(which brew) && file $(which brew)
# On a M1 MacBook the output should contain `arm64`
# Make sure the proper homebrew versions of curl and libressl to your PATH
# variable by adding the following line to your ~/.zshrc file:
export PATH="/opt/homebrew/opt/libressl/bin:$PATH"
export PATH="/opt/homebrew/opt/curl/bin:$PATH"
# List cached/unreadable certificates:
ddev exec ls -l /mnt/ddev-global-cache/mkcert
# ...and remove them:
ddev exec sudo rm -r /mnt/ddev-global-cache/mkcert/*
Randy Fay from ddev recommended these steps:
ddev poweroff
remove the mkcert_caroot from ~/.ddev/global_config.yaml
mkcert -uninstall && sudo chmod -R ugo+w "$(mkcert -CAROOT)" && rm -rf "$(mkcert -CAROOT)" && mkcert -install
Reboot
ddev start
He also recommended to read up on these articles:
https://github.com/FiloSottile/mkcert/issues/199
https://github.com/FiloSottile/mkcert/issues/431
https://github.com/FiloSottile/mkcert/issues?q=is%3Aissue+in%3Atitle+curl+
It might be necessary to adapt some of the paths mentioned in those articles, e.g. the path to homebrew's ssl, which is nowadays probably /opt/homebrew/etc. You can find out more by using this command:
> brew info openssl
Further commands that might be helpful:
> which mkcert
> mkcert --version
> grep mkcert_caroot ~/.ddev/global_config.yaml
It is possible to start a debug environment in ddev:
> ddev debug test
# Change "9871" in the folloing URL to whatever you get in your terminal:
> curl -I https://tryddevproject-9871.ddev.site