Cargo build doesn't work when system has self-signed certificates installed.

[rwz]

I have some self-signed certificates in my /etc/openssl/cert.pem on my working machine that I need for work. Because of that cargo build doesn't work:

$ cargo build --verbose
    Updating registry `https://github.com/rust-lang/crates.io-index`
 Downloading libc v0.1.9
Unable to get packages from source

Caused by:
  Failed to download package `libc v0.1.9` from https://crates.io/api/v1/crates/libc/0.1.9/download

Caused by:
  SSL peer certificate or SSH remote key was not OK

Now if I remove or rename the cert.pem file, everything works fine. The problem is, I do need these certificates for number of other things, and Cargo is the only tool complaining about it.

Is there a way make it work AND have self-signed certificates at the same time?

Versions:

$ cargo -V
cargo 0.3.0 (b030d35 2015-06-25) (built 2015-06-26)
$ rustc -V
rustc 1.1.0

[rwz]

After some digging around I found this issue: #976

Seems like the problem is only present in 1.1 stable and fixed in 1.2 beta. Is it possible to recompile 1.1 against fixed openssl and release rust 1.1.1 and cargo 0.3.1?

[alexcrichton]

Currently we haven't been issuing new stable releases for small bug fixes like this, but it does seem to be hitting a lot of people. @brson what do you think about this? The buildbots have been updated so we'd literally be building the same source code, we'd just bump some version numbers and link against some new native libraries.

@rwz in the meantime I'd recommend just downloading a beta cargo binary and copying it over the 1.1 cargo binary, after that you should be good to go :)

[brson]

I'd like to have a sense of how widespread the problem is, and to know how @rwz and others that are hitting this feel about moving to 1.2 beta until it becomes stable. If we can I prefer to tell people just wait a few weeks for 1.2, but if necessary it should not be too hard to create a point release.

[nealharris]

I'm seeing a similar issue with the nightlys:

~/Development/hello-rust/guessing_game master * cargo build --verbose
 Downloading rand v0.3.8
Unable to get packages from source

Caused by:
  Failed to download package `rand v0.3.8` from https://crates.io/api/v1/crates/rand/0.3.8/download

Caused by:
  Peer certificate cannot be authenticated with given CA certificates

I'm using rustc 1.3.0-nightly (0c052199b 2015-07-11) and cargo 0.4.0-nightly (15b497b 2015-07-08) (built 2015-07-10)

[nealharris]

Argh, ignore my previous comment. For posterity, I'm on OS X 10.10.4, and discovered that I had an expired Apple code signing cert at /usr/lib/ssl/cert.pem. Of course, that raises other questions for me about OS X...

[bIgBV]

I got this error when going through the guessing_game exercise and got here by searching for the same error on google. Plus I checked if I had any certificates that I created which expired in keychain access (New to ssl stuff so if there is anywhere else my certificates are stored then do tell because I checked in /usr/lib and the ssl directory wasn't present)

I'm using rustc 1.1.0 (35ceea399 2015-06-19) and cargo 0.2.0-nightly (a483581 2015-05-14) (built 2015-05-15)

[rats-gr]

I have the same issue (I think):

d:\-devel-\racer-master>cargo build --verbose
 Downloading rustc-serialize v0.3.15
Unable to get packages from source

Caused by:
  Failed to download package `rustc-serialize v0.3.15` from https://crates.io/api/v1/crates/rustc-serialize/0.3.15/download

Caused by:
  SSL connect error

d:\-devel-\racer-master>cargo --version
cargo 0.4.0-nightly (84ef25d 2015-07-23) (built 2015-07-24)

d:\-devel-\racer-master>ver

Microsoft Windows [Version 6.1.7601]

[towry]

Same issue here:

➜ test (master) ✗ cargo -V
cargo 0.4.0-nightly (15b497b 2015-07-08) (built 2015-07-09)
➜ test (master) ✗ rustc -V
rustc 1.2.0 (082e47636 2015-08-03)

Using curl give the following output:

➜ test (master) ✗ curl -v https://crates.io/api/v1/crates/libc/0.1.10/download
*   Trying 54.243.176.56...
* Connected to crates.io (54.243.176.56) port 443 (#0)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
* Server certificate: crates.io
* Server certificate: RapidSSL SHA256 CA - G3
* Server certificate: GeoTrust Global CA
> GET /api/v1/crates/libc/0.1.10/download HTTP/1.1
> Host: crates.io
> User-Agent: curl/7.43.0
> Accept: */*
> 
< HTTP/1.1 302 Found
< Connection: keep-alive
< Server: nginx
< Date: Wed, 02 Sep 2015 08:19:49 GMT
< Transfer-Encoding: chunked
< Set-Cookie: cargo_session=--3c156d7a3629aa08a1a0d538832f99ea30835cc8; HttpOnly; Secure; Path=/
< Location: https://crates-io.s3-us-west-1.amazonaws.com/crates/libc/libc-0.1.10.crate
< Strict-Transport-Security: max-age=31536000
< Via: 1.1 vegur
< 
* Connection #0 to host crates.io left intact

[radare]

Related #1978

[Byron]

I experience the same issue. Good to know how to workaround it though !

[kulbida]

The same here, any progress in this direction?

[alexcrichton]

I believe the original root cause was fixed some time ago, and otherwise this look like it's a dupe of #1689 so closing in favor of that.