Using cURL on MacOSX
Introduction
MacOSX comes with cURL and openssl pre-installed in the /usr/bin
directory and this uses Apple's Secure Transport. This means the MacOSX cURL will not accept PEM files for Two Way TLS client authentication and will result in an error.
MacOSX cURL does allow the use of PFX files, but it works by populating the MacOSX keychain with the private key on first run of cURL.
The use of PEM files can be achieved by installing a brew version of cURL and openssl. The use of PEM files is important when using third party applications like PHP which comes pre-installed, but is compiled with a version of cURL that uses Apple's Secure Transport (brew PHP install instructions are provided below).
Brew install of openssl and cURL on MacOSX
Verify default installed versions
From a terminal run the following to identity the version and location of your current cURL binary:
curl --version
which curl # normally defaulted to location /usr/bin/curl
Run the following to verify that PHP is installed on your MacOSX:
php -i | grep "SSL Version"
you'll see this if PHP is compiled to use Apple's Secure Transport:
SSL Version => SecureTransport
Install cURL with openssl using brew
Brew is installed on MacOSX by default. The instructions provided below can be used to install and uninstall the brew versions of cURL and openssl.
Note: Installing cURL and openssl independently will not work. Run the single command below to ensure they tie-up together.
brew install --with-openssl curl
Setup your local path to access cURL and openssl from the /usr/local/opt
directory.
export PATH="/usr/local/opt/curl/bin:$PATH"
export PATH="/usr/local/opt/openssl/bin:$PATH"
Use the commands below to verify the cURL version and binary being used.
curl --version
which curl
Uninstall cURL with openssl
To use the original MacOSX cURL and openssl, revert the PATH changes above.
Run the following commands to uninstall brew versions of cURL and openssl.
brew uninstall curl
brew uninstall openssl
Two Way TLS using PFX
The SAC downloaded from the portal will be a PFX containing the the public certificate and private key. The following example shows how MacOSX pre-installed cURL on the command line can be used to perform Two Way TLS client authentication using this PFX.
curl -d -X POST <url> -E <pfx> --pass <pfx password>
On MacOSX this works by adding the private key into the keychain for client authentication to access. You may be requested by the keychain to allow access if you had previously imported into the keychain by other means.
Two Way TLS using PEM and brew version of cURL
The pre-installed MacOSX openssl will not covert PFX to PEM successfully. Use the brew version of openssl to convert the PFX into PEM format.
To export the PFX into a single PEM file.
openssl pkcs12 -in <pfx> -out <file.withkey.pem>
Run the same cURL command as before but this time passing in the PEM file.
curl -d -X POST <url> -E <file.withkey.pem> --pass <pem password>
Note: The above will fail when using pre-installed cURL on MacOSX.
Install brew version of PHP
Ensure you have the latest version of XCode and install xcode-select
. The brew PHP install will be trying to find the zlib
library within the XCode directory.
xcode-select --install
Setup brew to tap into other additional GIT repositories for PHP installable components.
brew tap homebrew/versions
brew tap homebrew/php
Identify the version of apache installed on your MacOSX.
httpd -v
If the version is not using apache 2.4, you can remove --with-httpd24
from the below command.
Install PHP using the brew version of cURL and openssl.
brew install --with-homebrew-curl --with-httpd24 php55
Setup the path to run brew PHP from the command line.
export PATH="$(brew --prefix homebrew/php/php55)/bin:$PATH"
Verify that PHP on the command line is not using Apple's Secure Transport.
php -i | grep "SSL Version"
The SSL Version returned should not refer to Secure Transport.
SSL Version => OpenSSL/1.0.2l
The RapID PHP server SDK will work successfully with the brew version of PHP.
If the brew version of PHP is required in Apache, then follow the brew instructions displayed after a successful install.