I am making a new Emacs config an in it, I have the following lines

(with-eval-after-load 'tls
  (push "/private/etc/ssl/cert.pem" gnutls-trustfiles)
  (setf gnutls-verify-error nil)
  (setf tls-checktrust t))

;; Initialize package sources
(require 'package)
(setq package-archives '(("melpa" . "https://melpa.org/packages/")
             ("melpa-stable" . "https://stable.melpa.org/packages/")

(unless package-archive-contents

The issue is that the connection to Melpa servers fails with the following error

Failed to download ‘melpa’ archive.
Opening TLS connection to ‘stable.melpa.org’...
Opening TLS connection with ‘gnutls-cli --x509cafile /private/etc/ssl/cert.pem -p 443 stable.melpa.org’...failed
Opening TLS connection with ‘gnutls-cli --x509cafile /private/etc/ssl/cert.pem -p 443 stable.melpa.org --protocols ssl3’...failed
Opening TLS connection to ‘stable.melpa.org’...failed
Package refresh done

Furthermore, when I manually test the following command at the command line, it seems to work

gnutls-cli --x509cafile /private/etc/ssl/cert.pem -p 443 --no-strict-tofu stable.melpa.org
Processed 128 CA certificate(s).
Resolving 'stable.melpa.org:443'...
Connecting to 'xxx.xxx.xxx.xxx:443'...
- Certificate type: X.509
- Got a certificate list of 3 certificates.
- Certificate[0] info:

While, the following command fails the checks

gnutls-cli --x509cafile /private/etc/ssl/cert.pem -p 443 stable.melpa.org
- Status: The certificate is NOT trusted. The certificate issuer is unknown.
*** PKI verification of server certificate failed...
*** Fatal error: Error in the certificate.

How can I make the Emacs config work? My understanding is that it fails due to certificate check errors (self-signed certificates).

1 Answer 1


If adding --no-strict-tofu makes the gnutls-cli invocation work, then customize tls-program to include that flag.

Longer term it would be better to get an Emacs with builtin GnuTLS support, that tends to handle these issues much better.

  • Should I compile it with a certain config flag set to get builtin GnuTLS support? Oct 31, 2023 at 11:48
  • It's autodetected if you have the GnuTLS headers, they're usually in a package called "gnutls-dev" or similar
    – rpluim
    Oct 31, 2023 at 13:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.