curl / Mailing Lists / curl-library / Single Mail
Buy commercial curl support from WolfSSL. We help you work out your issues, debug your libcurl applications, use the API, port to new platforms, add new features and more. With a team lead by the curl founder himself.

Re: Curl thinks SSL cert for has expired

From: Mark Rogers via curl-library <>
Date: Thu, 4 Jun 2020 10:23:51 +0000

On macOS 10.15 you can work round this issue by switching the curl SSL backend from LibreSSL to Apple Secure Transport using an environment variable:


This fixes the 'certificate expired' issue on 10.15 but doesn't work on 10.14. I believe switching to Secure Transport also disables HTTP/2 support in curl.

Best Regards

On 01/06/2020, 23:25, "Felipe Gasper" <> wrote:

    It’s the Sectigo (fka Comodo) “AddTrust” root certificate, which just expired on Saturday.

    The standard root bundle includes a “UserTrust” root certificate that’s signed by that AddTrust certificate, and the presence of that certificate in the root bundle should obviate any need for the AddTrust root, but apparently OpenSSL is failing the validation because of the expired AddTrust root even though UserTrust is a trusted root.

    More details about the Sectigo side:


> On Jun 1, 2020, at 4:57 PM, Daniel Stenberg via curl-library <> wrote:
> On Mon, 1 Jun 2020, Mark Rogers via curl-library wrote:
>> Using curl on macOS 10.15.4
> ...
>> Is this a LibreSSL issue?
> Yes. This is a LibreSSL issue, also found in OpenSSL before 1.1.0, in all versions of GnuTLS and probably in some other TLS libs too.
> From my understanding, the issue seems to be that these libraries have flaws and beleive there's a problem with an expired cert, even though there is another trust chain that doesn't include the expired cert.
> --
> / | Commercial curl support up to 24x7 is available!
> | Private help, bug fixes, support, ports, new features
> |
> -------------------------------------------------------------------
> Unsubscribe:
> Etiquette:

Received on 2020-06-04