Apple Event: May 7th at 7 am PT
This article (https://support.apple.com/en-us/HT204446#:~:text=To%20update%20a%20certificate%2C%20in,certificate%20profile%2C%20then%20click%20Update.) claims "To update a certificate, in the Profiles pane of System Preferences, click the certificate profile, then click"
But there is no "certificate profile" in System Preferences on Catalina. wtfo??
MacBook Pro 16″, macOS 10.15
Apple updates root CA certificates when it releases updates.
The article you read about profile-based certificate updates are for companies to distribute certificates for the company using their Mobile Device Management system. It is not for normal users to update certificates.
Did you try to download it in Safari or another browser?
Once downloaded, copy it to /usr/local/bin
The version of curl installed on Catalina may not have access to the current root CAs
Apple updates root CA certificates when it releases updates.
The article you read about profile-based certificate updates are for companies to distribute certificates for the company using their Mobile Device Management system. It is not for normal users to update certificates.
Did you try to download it in Safari or another browser?
Once downloaded, copy it to /usr/local/bin
The version of curl installed on Catalina may not have access to the current root CAs
I'm not a company. I'm a person. I asked this question because of an issue that has come up trying to use `curl` to download a utility from a `https` website iaw these instructions. Attempting a download of this on my Macbook Pro (Catalina) gives an error:
curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html
The "more details" webpage did not provide a clear resolution, except that it seemed the issue was with the administrators of the website: https://yt-dl.org
When I asked the youtube-dl maintainers at github about it, they insisted that their certificate was current and valid, and provided this link as providing "the answer" to resolution of the issue!?!
As I read throught this, I was impressed by the following statement:
What You Need to Do
or most use cases, including certificates serving modern client or server systems, no action is required, whether or not you have issued certificates cross-chained to the AddTrust root.
And so it seems that the youtube-dl maintainers feel *strongly* this is not their problem. I asked the question in an effort to determine if there was something I needed to do, or could do to rectify the issue.
Yes - for companies... if the page indicated it was for companies only, then I missed that.
And thanks! - your reply has triggered more questions:
How would I download the "CA certificate" to put into /usr/local/bin?
I'm using the `curl` that was shipped with macOS Catalina when I bought it earlier this year. Are you suggesting that another version might be more likelyto have access?
I meant to download the thing you are trying to download. Curl is just a command line browser, of sorts, to download files. Copy the URL and paste it into Safari and it will download the file.
To open a Finder window at /usr/local/bin, use Go To Folder in Finder and copy/paste in that path. You can then copy the file from Downloads into /usr/local/bin.
I'm sorry - that solution might work for some, but it doesn't work for me - in this case as I need to get cURL to work properly.
It used to work properly - until recently, curl was able to verify certificates. It no longer seems to be able to do that, and I must understand why so that it can be restored.
Seems odd that doesn't work.
You'll have to either install a newer version of curl or LibreSSL on your Mac to fix the problem with curl. Curl uses LibreSSL for secure transport, so that is likely the culprit.
Maybe search for how to update certs in LibreSSL.
Does your company use profile-based certificates?
You won't see anything in the System Preferences unless those are managed by your company.
Updating Certificates/CAs
