High Sierra issues with unsigned SSL certificate and local curl - ssl

Question

For several OSX versions, I've been using these tutorials to set up a local development environment, including SSL.
I've also always been able to create dynamic virtual hosts based on the folder structure like this:
# Auto-VirtualHosts with .dev
<VirtualHost *:8080>
ServerName dev
ServerAlias *.dev
CustomLog "/Users/username/Sites/logs/dev-access_log" combinedmassvhost
ErrorLog "/Users/username/Sites/logs/dev-error_log"
VirtualDocumentRoot /Users/username/Sites/%-2+
</VirtualHost>
<VirtualHost *:8443>
ServerName dev
ServerAlias *.dev
Include "/Users/username/Sites/ssl/ssl-shared-cert.inc"
CustomLog "/Users/username/Sites/logs/dev-access_log" combinedmassvhost
ErrorLog "/Users/username/Sites/logs/dev-error_log"
VirtualDocumentRoot /Users/username/Sites/%-2+
</VirtualHost>
The included SSL file there is like this:
SSLEngine On
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
SSLCertificateFile "/usr/local/etc/httpd/server.crt"
SSLCertificateKeyFile "/usr/local/etc/httpd/server.key"
And to generate that certificate I run this code:
$ cd /usr/local/etc/httpd
$ openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout server.key -out server.crt
This has always worked okay for me, locally. I can run curl successfully, and especially in WordPress development I can run cron tasks that presumably use curl.
Upon upgrading to High Sierra, I get the following error in WordPress:
There was a problem spawning a call to the WP-Cron system on your site. This means WP-Cron events on your site may not work. The problem was:
cURL error 60: SSL certificate problem: self signed certificate
And on the command line, when I run curl to a local HTTPS URL, I get this error:
curl: (60) SSL certificate problem: self signed certificate
More details here: https://curl.haxx.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
I've tried reinstalling all the items from the initial tutorial, but so far nothing has helped. I've also tried installing curl from the Homebrew version instead of the built in, but this didn't seem to have any effect. Is there something known about High Sierra that would make it more picky about this? If so, is there anything I can do to bypass this for local development?

Answer 1

You have to add your self-signed certificate to the curl CA certificate store.
First you have to generate the ca bundle by running the perl script stored in:
/usr/local/Cellar/curl/7.56.1/libexec/mk-ca-bundle.pl
Edit the generated file:
/usr/local/Cellar/curl/7.56.1/libexec/ca-bundle.crt
and add your self-signed certificate using the same syntax.
You can obtain the certificate with:
openssl s_client -showcerts -connect my.server.com:443
Copy everything from :
-----BEGIN CERTIFICATE-----
to
-----END CERTIFICATE-----
including the BEGIN and ENDlines.
Create then a file ~/.curlrc containing:
cacert /usr/local/Cellar/curl/7.56.1/libexec/ca-bundle.crt