The following code should in principle return the contents of https://badssl.com
(with-current-buffer (url-retrieve-synchronously "https://badssl.com") (buffer-string))
But with my
GNU Emacs 18.104.22.168 (x86_64-apple-darwin13.4.0, NS appkit-1265.21 Version 10.9.5 (Build 13F1112)) of 2015-08-24 on OS X 10.10.5, run with
-Q, it instead shows me this message:
Certificate information Issued by: COMODO RSA Domain Validation Secure Server CA Issued to: Domain Control Validated Hostname: *.badssl.com Public key: RSA, signature: RSA-SHA256 Protocol: TLS1.2, key: ECDHE-RSA, cipher: AES-128-GCM, mac: AEAD Security level: Medium Valid: From 2015-04-09 to 2016-07-07 The TLS connection to badssl.com:443 is insecure for the following reasons: the certificate was signed by an unknown and therefore untrusted authority certificate could not be verified
and asks whether to accept the certificate - No/Session/Always. It then works if I accept the certificate.
Moreover, there appear to be two separate customization groups - gnutls and tls. I have previously compiled emacs with support for gnutls (
t). Gnutls was installed with homebrew.
If I set
t, I instead get the error
gnutls-negotiate: Certificate validation failed badssl.com, verification code 42
so presumably gnutls was not being used in the first example. On OS X none of the files mentioned in
So how can I configure emacs to use the default trusted root certificates on OS X?
Edit: If I install
libressl from homebrew, and add
gnutls-trustfiles, the issue disappears when using
gnutls-verify-error set to t.
Edit 2: In my testing it didn't seem like the value of
tls-certtool-program was actually used, but it may be incorrect for OS X anyway: the default certtool on OS X is not the GnuTLS certtool required by tls.el, and with homebrew's gnutls I think it should be gnutls-certtool instead.