macOS Sierra no longer trusts the puma-dev certificate

[benubois]

Hi,

After upgrading to Sierra, Safari and Chrome show an SSL error when trying to access sites served by puma-dev over https. Uninstalling and reinstalling puma-dev did not have any effect. Furthermore it appears that uninstalling does not remove the io.puma.dev directory and reinstalling does not prompt you to trust the certificate again.

I manually deleted ~/Application Support/io.puma.dev and reinstalled which did prompt me to trust the certificate again, but still had invalid certificate errrors.

Thanks for puma-dev!

[levriero]

I encountered the same issue, I also tried uninstalling and regenerating the certificates but still had errors.

A dirty workaround is to open the url with Safari, then selecting Always trust this certificate in the pop up window. Subsequent requests to that url will work as expected.

[navied]

@gbonfant I tried that same method, but I found that it eventually goes back to not trusting it again.

[joshmanders]

I fixed this issue by opening Keychain Access and moving the Puma-dev CA certificate into the System column under keychains then restarting my browser.

[rwilcox]

@joshmanders good find! This trick worked for me: went from having to bypass the security once every 5 minutes to not being asked at all (granted, it's only been an hour, but...)

[joshmanders]

It only worked for an hour for you? I've been going fine since doing it few hours ago.

[rwilcox]

I mean it was working, and stayed working for at least an hour, but then I had to stop coding...

[koenpunt]

The Keychain on macOS has been renamed, which could be the cause of this problem.

[attilagyorffy]

Currently puma-dev uses a hardcoded login.keychain file to add the certificate however the login keychain file in macOS has been renamed as @koenpunt points out.

I think we should try to use the security tool to identify the right file during the setup. In the meanwhile you can use the following command:

security add-trusted-cert -k $(security login-keychain) ~/Library/Application\ Support/io.puma.dev/cert.pem

I'll try to find the time and submit a patch, assuming @evanphx agrees with my approach.

[attilagyorffy]

I did create a patch that checks for the existence of the new keychain path and uses that if it's present. See #95, perhaps when @evanphx will have time to review it, it may get merged in.

[danrabinowitz]

Thanks! The original version from @attilagyorffy didn't quite work for me, but this one did:

security add-trusted-cert -k login.keychain-db ~/Library/Application\ Support/io.puma.dev/cert.pem

[attilagyorffy]

@danrabinowitz can i ask what did you get after having run my command mentioned above?

[danrabinowitz]

Sure. :-)

~ $ security add-trusted-cert -k $(security login-keychain) ~/Library/Application\ Support/io.puma.dev/cert.pem
SecCertificateAddToKeychain: The specified keychain could not be found.
1:~ $ security login-keychain
    "/Users/danrabinowitz/Library/Keychains/login.keychain-db"

I decided to try (based only on a guess) using just the filename without the full path, and it worked.