brew search xxx: curl: (35) SSL certificate problem: Couldn't understand the server certificate format

[edrozenberg]

Please follow the general troubleshooting steps first:

• [x] Ran brew update and retried your prior step?
• [x] Ran brew doctor, fixed as many issues as possible and retried your prior step?
• [x] If you're seeing permission errors tried running sudo chown -R $(whoami) $(brew --prefix)?
• [x] Confirmed this is problem with Homebrew/brew and not specific formulae? If it's a formulae-specific problem please file this issue at https://github.com/Homebrew/homebrew-core/issues/new

Bug reports:

I'm seeing the following error on one machine, but not another. Would really appreciate a tip on what specific curl command brew search is running that might be failing so I can run that curl command manually and troubleshoot further.

$ brew search pip --verbose
aespipe                    pipebench                  pipeviewer
brew-pip                   pipemeter                  pyenv-pip-migrate
lesspipe                   pipes-sh                   spiped
homebrew/completions/pip-completion      homebrew/science/methpipe
homebrew/science/bpipe

If you meant "pip" precisely:

Homebrew provides pip via: `brew install python`. However you will then
have two Pythons installed on your Mac, so alternatively you can install
pip via the instructions at:
  https://pip.readthedocs.io/en/stable/installing/
Error: curl failed!   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (35) SSL certificate problem: Couldn't understand the server certificate format
curl: (3) <url> malformed

I've already looked at this similar closed issue: https://github.com/Homebrew/brew/issues/1324

The root cause in that issue appeared to be a corporate network using man-in-the-middle certificate(s), but I'm not on a corporate network and not using any custom certificates (that I know of :).

[edrozenberg]

Strange - just tried the same command now on the same machine that had the problem and now NO ERROR. Some kind of intermittent GitHub issue? Would still be good to know what the curl command brew search is running that was failing.

[edrozenberg]

The problem is back. No idea.

[tulushev]

It seems I have the same issue

$ brew update
fatal: unable to access 'https://github.com/Homebrew/brew.git/': SSL certificate problem: Couldn't understand the server certificate format
fatal: unable to access 'https://github.com/d12frosted/homebrew-emacs-plus/': SSL certificate problem: Couldn't understand the server certificate format
fatal: unable to access 'https://github.com/Homebrew/homebrew-binary/': SSL certificate problem: Couldn't understand the server certificate format
fatal: unable to access 'https://github.com/Homebrew/homebrew-core/': SSL certificate problem: Couldn't understand the server certificate format
fatal: unable to access 'https://github.com/Homebrew/homebrew-games/': SSL certificate problem: Couldn't understand the server certificate format
fatal: unable to access 'https://github.com/neovim/homebrew-neovim/': SSL certificate problem: Couldn't understand the server certificate format
fatal: unable to access 'https://github.com/railwaycat/homebrew-emacsmacport/': SSL certificate problem: Couldn't understand the server certificate format
fatal: unable to access 'https://github.com/thoughtbot/homebrew-formulae/': SSL certificate problem: Couldn't understand the server certificate format
Error: Fetching /usr/local/Homebrew failed!
Fetching /usr/local/Homebrew/Library/Taps/d12frosted/homebrew-emacs-plus failed!
Fetching /usr/local/Homebrew/Library/Taps/homebrew/homebrew-binary failed!
Fetching /usr/local/Homebrew/Library/Taps/homebrew/homebrew-core failed!
Fetching /usr/local/Homebrew/Library/Taps/homebrew/homebrew-games failed!
Fetching /usr/local/Homebrew/Library/Taps/neovim/homebrew-neovim failed!
Fetching /usr/local/Homebrew/Library/Taps/railwaycat/homebrew-emacsmacport failed!
Fetching /usr/local/Homebrew/Library/Taps/thoughtbot/homebrew-formulae failed!

Same thing with brew search

$ brew search pip --verbose
aespipe                     lesspipe                    pipemeter                   pipeviewer                  spiped
brew-pip                    pipebench                   pipes-sh                    pyenv-pip-migrate

If you meant "pip" precisely:

Homebrew provides pip via: `brew install python`. However you will then
have two Pythons installed on your Mac, so alternatively you can install
pip via the instructions at:
  https://pip.readthedocs.io/en/stable/installing/
Error: curl failed!   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (35) SSL certificate problem: Couldn't understand the server certificate format
curl: (3) <url> malformed

I'm on a home network, and everything worked the day before.

[MikeMcQuaid]

Sorry but you have not followed the requested steps on the Troubleshooting page

Please follow (all of) these steps and post the information here so we can help you with your problem.

Thanks!

[edrozenberg]

Thanks, I think this is the only thing I haven't submitted yet.
doctor is clean no problems.
Not seeing the curl problem today.

$ brew config
HOMEBREW_VERSION: 1.1.2
ORIGIN: https://github.com/Homebrew/brew
HEAD: 0f529dae1043639058130092cf35e68d18907cb8
Last commit: 8 days ago
Core tap ORIGIN: https://github.com/Homebrew/homebrew-core
Core tap HEAD: 88cfb1560bf02d5c10077a243f95652e95a7806b
Core tap last commit: 19 hours ago
HOMEBREW_PREFIX: /usr/local
HOMEBREW_REPOSITORY: /usr/local/Homebrew
HOMEBREW_CELLAR: /usr/local/Cellar
HOMEBREW_BOTTLE_DOMAIN: https://homebrew.bintray.com
CPU: octa-core 64-bit ivybridge
Homebrew Ruby: 2.0.0-p648
Clang: 8.0 build 800
Git: 2.11.0 => /usr/local/bin/git
Perl: /usr/bin/perl
Python: /usr/local/bin/python => /usr/local/Cellar/python/2.7.12_2/Frameworks/Python.framework/Versions/2.7/bin/python2.7
Ruby: /usr/local/bin/ruby => /usr/local/Cellar/ruby/2.3.3/bin/ruby
Java: 1.8.0_112
macOS: 10.12.1-x86_64
Xcode: 8.1
CLT: 8.1.0.0.1.1476494586
X11: N/A

[MikeMcQuaid]

I'm afraid there's nothing Homebrew can do if you can't connect to GitHub. It's performing a normal curl query to https://api.github.com.

[edrozenberg]

Thanks, might be some kind of MacOS issue. Had SSL CERT errors at one point in Google Chrome trying to open google.com, and running brew search pip at that time gave the curl (35) ssl error also. Logging out and back in fixed the issue.

[edrozenberg]

Documenting here for anyone else coming by. Similar-sounding problems also reported by John Siracusa of ATP Podcast on the Dec 7 podcast.

Most likely trigger for the problem: enabling iCloud Keychain in iCloud settings

One or more observable symptoms when issue is happening:

• A pop-up MacOS message that keychain has to be repaired/reset
• When looking at Keychain Access tool, keychains appear to be empty and set to Read-Only mode
• When looking at Keychain Access tool, keychain icons on sidebar are missing (dotted borders)
• Trying to navigate to https://google.com in Google Chrome fails with an SSL CERT error
• Running brew search pip for example, shows the curl (35) certificate error message

The problem can be temporarily resolved by logging out and back in, and/or rebooting. After it is resolved, the Keychain Access tool will show all the keychains and their contents as it should. The problem is likely to recur at a later time.

Hoping (fingers X) that a Mac OS patch (maybe 10.12.2?) will resolve the root cause.

Otherwise one idea is to disable the iCloud Keychain option in iCloud prefs (have not yet tried).

[jeffcrilly]

Simply using a new shell window worked for me.