Closed rabol closed 4 months ago
Not super sure but @adrum could this be related to your PR? https://github.com/laravel/valet/pull/1463
Not super sure but @adrum could this be related to your PR? #1463
I'll try to reproduce this.
@rabol What browser are you seeing this error in? Can you confirm if the Laravel CA is trusted in Keychain? It should happen whenever you call valet secure
.
It happens in Safari and Chrome As far as I can see the CA is trusted, but I still get the error :(
@rabol Can you run the following commands and let me know the output?
security verify-cert -c ~/.config/valet/CA/LaravelValetCASelfSigned.pem
security verify-cert -c ~/.config/valet/Certificates/app.test.crt
openssl verify -CAfile ~/.config/valet/CA/LaravelValetCASelfSigned.pem ~/.config/valet/Certificates/app.test.crt
cat ~/.config/valet/Nginx/app.test
curl --insecure -vvI https://app.test 2>&1 | awk 'BEGIN { cert=0 } /^\* SSL connection/ { cert=1 } /^\*/ { if (cert) print }'
Be sure to replace app.test.crt
in 2 & 3, and app.test
in 4 & 5 with the domain you are experiencing the issue with. Feel free to redact any info in step 4.
Hey! I’m running into issue as well.
Error: NET::ERR_CERT_DATE_INVALID
Cert Verify Result: CSSMERR_TP_CERT_EXPIRED
Cert Verify Result: CSSMERR_TP_CERT_EXPIRED
O=Laravel Valet CA Self Signed Organization, CN=Laravel Valet CA Self Signed CN, OU=Developers, emailAddress=rootcertificate@laravel.valet
error 10 at 1 depth lookup: certificate has expired
error /Users/balu/.config/valet/Certificates/app.test.crt: verification failed
server {
listen 127.0.0.1:80;
#listen 127.0.0.1:80; # valet loopback
server_name app.test www.app.test *.app.test;
return 301 https://$host$request_uri;
}
server { listen 127.0.0.1:443 ssl;
server_name app.test www.app.test *.app.test;
root /;
charset utf-8;
client_max_body_size 512M;
http2 on;
location /41c270e4-5535-4daa-b23e-c269744c2f45/ {
internal;
alias /;
try_files $uri $uri/;
}
ssl_certificate "/Users/balu/.config/valet/Certificates/app.test.crt";
ssl_certificate_key "/Users/balu/.config/valet/Certificates/app.test.key";
location / {
rewrite ^ "/Users/balu/.composer/vendor/laravel/valet/server.php" last;
}
location = /favicon.ico { access_log off; log_not_found off; }
location = /robots.txt { access_log off; log_not_found off; }
access_log off;
error_log "/Users/balu/.config/valet/Log/nginx-error.log";
error_page 404 "/Users/balu/.composer/vendor/laravel/valet/server.php";
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass "unix:/Users/balu/.config/valet/valet.sock";
fastcgi_index "/Users/balu/.composer/vendor/laravel/valet/server.php";
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME "/Users/balu/.composer/vendor/laravel/valet/server.php";
fastcgi_param PATH_INFO $fastcgi_path_info;
}
location ~ /\.ht {
deny all;
}
}
server { listen 127.0.0.1:60;
server_name app.test www.app.test *.app.test;
root /;
charset utf-8;
client_max_body_size 128M;
add_header X-Robots-Tag 'noindex, nofollow, nosnippet, noarchive';
location /41c270e4-5535-4daa-b23e-c269744c2f45/ {
internal;
alias /;
try_files $uri $uri/;
}
location / {
rewrite ^ "/Users/balu/.composer/vendor/laravel/valet/server.php" last;
}
location = /favicon.ico { access_log off; log_not_found off; }
location = /robots.txt { access_log off; log_not_found off; }
access_log off;
error_log "/Users/balu/.config/valet/Log/nginx-error.log";
error_page 404 "/Users/balu/.composer/vendor/laravel/valet/server.php";
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass "unix:/Users/balu/.config/valet/valet.sock";
fastcgi_index "/Users/balu/.composer/vendor/laravel/valet/server.php";
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME "/Users/balu/.composer/vendor/laravel/valet/server.php";
fastcgi_param PATH_INFO $fastcgi_path_info;
}
location ~ /\.ht {
deny all;
}
}
5.
Fix will be included in tomorrow's release. Thanks everyone!
Sorry, the new version did not solve the issue for me Note: I have used the
valet trust
Command so I do not get prompted for passwords. I tried to turn it off, then I get prompted for passwrd, but the result is the same.
here is the output of the 5 command that @adrum asked for
➜ ~ security verify-cert -c ~/.config/valet/CA/LaravelValetCASelfSigned.pem
...certificate verification successful.
➜ ~ security verify-cert -c ~/.config/valet/CA/LaravelValetCASelfSigned.pem
...certificate verification successful.
➜ ~ security verify-cert -c ~/.config/valet/Certificates/sign.test.crt
Cert Verify Result: CSSMERR_TP_NOT_TRUSTED
➜ ~ openssl verify -CAfile ~/.config/valet/CA/LaravelValetCASelfSigned.pem ~/.config/valet/Certificates/app.test.crt
Could not open file or uri for loading certificate file from /Users/rabol/.config/valet/Certificates/app.test.crt: No such file or directory
➜ ~ openssl verify -CAfile ~/.config/valet/CA/LaravelValetCASelfSigned.pem ~/.config/valet/Certificates/sign.test.crt
/Users/rabol/.config/valet/Certificates/sign.test.crt: OK
➜ ~ cat ~/.config/valet/Nginx/sign.test
server {
listen 127.0.0.1:80;
#listen 127.0.0.1:80; # valet loopback
server_name sign.test www.sign.test *.sign.test;
return 301 https://$host$request_uri;
}
server {
listen 127.0.0.1:443 ssl;
#listen VALET_LOOPBACK:443 ssl; # valet loopback
server_name sign.test www.sign.test *.sign.test;
root /;
charset utf-8;
client_max_body_size 512M;
http2 on;
location /41c270e4-5535-4daa-b23e-c269744c2f45/ {
internal;
alias /;
try_files $uri $uri/;
}
ssl_certificate "/Users/rabol/.config/valet/Certificates/sign.test.crt";
ssl_certificate_key "/Users/rabol/.config/valet/Certificates/sign.test.key";
location / {
rewrite ^ "/Users/rabol/.composer/vendor/laravel/valet/server.php" last;
}
location = /favicon.ico { access_log off; log_not_found off; }
location = /robots.txt { access_log off; log_not_found off; }
access_log off;
error_log "/Users/rabol/.config/valet/Log/nginx-error.log";
error_page 404 "/Users/rabol/.composer/vendor/laravel/valet/server.php";
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass "unix:/Users/rabol/.config/valet/valet.sock";
fastcgi_index "/Users/rabol/.composer/vendor/laravel/valet/server.php";
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME "/Users/rabol/.composer/vendor/laravel/valet/server.php";
fastcgi_param PATH_INFO $fastcgi_path_info;
}
location ~ /\.ht {
deny all;
}
}
server {
listen 127.0.0.1:60;
#listen 127.0.0.1:60; # valet loopback
server_name sign.test www.sign.test *.sign.test;
root /;
charset utf-8;
client_max_body_size 128M;
add_header X-Robots-Tag 'noindex, nofollow, nosnippet, noarchive';
location /41c270e4-5535-4daa-b23e-c269744c2f45/ {
internal;
alias /;
try_files $uri $uri/;
}
location / {
rewrite ^ "/Users/rabol/.composer/vendor/laravel/valet/server.php" last;
}
location = /favicon.ico { access_log off; log_not_found off; }
location = /robots.txt { access_log off; log_not_found off; }
access_log off;
error_log "/Users/rabol/.config/valet/Log/nginx-error.log";
error_page 404 "/Users/rabol/.composer/vendor/laravel/valet/server.php";
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass "unix:/Users/rabol/.config/valet/valet.sock";
fastcgi_index "/Users/rabol/.composer/vendor/laravel/valet/server.php";
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME "/Users/rabol/.composer/vendor/laravel/valet/server.php";
fastcgi_param PATH_INFO $fastcgi_path_info;
}
location ~ /\.ht {
deny all;
}
}
➜ ~
➜ ~
➜ ~ curl --insecure -vvI https://sign.test 2>&1 | awk 'BEGIN { cert=0 } /^\* SSL connection/ { cert=1 } /^\*/ { if (cert) print }'
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF
* ALPN: server accepted h2
* Server certificate:
* subject: CN=sign.test; emailAddress=sign.test@laravel.valet
* start date: Jun 26 06:35:50 2024 GMT
* expire date: Jun 29 06:35:50 2025 GMT
* issuer: O=Laravel Valet CA Self Signed Organization; CN=Laravel Valet CA Self Signed CN; OU=Developers; emailAddress=rootcertificate@laravel.valet
* SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://sign.test/
* [HTTP/2] [1] [:method: HEAD]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: sign.test]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.6.0]
* [HTTP/2] [1] [accept: */*]
* Connection #0 to host sign.test left intact
@adrum ^
Hey! I’m running into issue as well.
Error:
NET::ERR_CERT_DATE_INVALID
Running commands:
Cert Verify Result: CSSMERR_TP_CERT_EXPIRED
Cert Verify Result: CSSMERR_TP_CERT_EXPIRED
O=Laravel Valet CA Self Signed Organization, CN=Laravel Valet CA Self Signed CN, OU=Developers, emailAddress=rootcertificate@laravel.valet error 10 at 1 depth lookup: certificate has expired error /Users/balu/.config/valet/Certificates/app.test.crt: verification failed
server { listen 127.0.0.1:80; #listen 127.0.0.1:80; # valet loopback server_name app.test www.app.test *.app.test; return 301 https://$host$request_uri; } server { listen 127.0.0.1:443 ssl; #listen VALET_LOOPBACK:443 ssl; # valet loopback server_name app.test www.app.test *.app.test; root /; charset utf-8; client_max_body_size 512M; http2 on; location /41c270e4-5535-4daa-b23e-c269744c2f45/ { internal; alias /; try_files $uri $uri/; } ssl_certificate "/Users/balu/.config/valet/Certificates/app.test.crt"; ssl_certificate_key "/Users/balu/.config/valet/Certificates/app.test.key"; location / { rewrite ^ "/Users/balu/.composer/vendor/laravel/valet/server.php" last; } location = /favicon.ico { access_log off; log_not_found off; } location = /robots.txt { access_log off; log_not_found off; } access_log off; error_log "/Users/balu/.config/valet/Log/nginx-error.log"; error_page 404 "/Users/balu/.composer/vendor/laravel/valet/server.php"; location ~ [^/]\.php(/|$) { fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_pass "unix:/Users/balu/.config/valet/valet.sock"; fastcgi_index "/Users/balu/.composer/vendor/laravel/valet/server.php"; include fastcgi_params; fastcgi_param SCRIPT_FILENAME "/Users/balu/.composer/vendor/laravel/valet/server.php"; fastcgi_param PATH_INFO $fastcgi_path_info; } location ~ /\.ht { deny all; } } server { listen 127.0.0.1:60; #listen 127.0.0.1:60; # valet loopback server_name app.test www.app.test *.app.test; root /; charset utf-8; client_max_body_size 128M; add_header X-Robots-Tag 'noindex, nofollow, nosnippet, noarchive'; location /41c270e4-5535-4daa-b23e-c269744c2f45/ { internal; alias /; try_files $uri $uri/; } location / { rewrite ^ "/Users/balu/.composer/vendor/laravel/valet/server.php" last; } location = /favicon.ico { access_log off; log_not_found off; } location = /robots.txt { access_log off; log_not_found off; } access_log off; error_log "/Users/balu/.config/valet/Log/nginx-error.log"; error_page 404 "/Users/balu/.composer/vendor/laravel/valet/server.php"; location ~ [^/]\.php(/|$) { fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_pass "unix:/Users/balu/.config/valet/valet.sock"; fastcgi_index "/Users/balu/.composer/vendor/laravel/valet/server.php"; include fastcgi_params; fastcgi_param SCRIPT_FILENAME "/Users/balu/.composer/vendor/laravel/valet/server.php"; fastcgi_param PATH_INFO $fastcgi_path_info; } location ~ /\.ht { deny all; } }
* SSL connection using TLSv1.3 / AEAD-AES256-GCM-SHA384 * ALPN: server accepted h2 * Server certificate: * subject: CN=app.test; emailAddress=app.test@laravel.valet * start date: Jun 24 13:45:30 2024 GMT * expire date: Jun 27 13:45:30 2025 GMT * issuer: O=Laravel Valet CA Self Signed Organization; CN=Laravel Valet CA Self Signed CN; OU=Developers; emailAddress=rootcertificate@laravel.valet * SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway. * using HTTP/2 * [HTTP/2] [1] OPENED stream for https://app.test/ * [HTTP/2] [1] [:method: HEAD] * [HTTP/2] [1] [:scheme: https] * [HTTP/2] [1] [:authority: app.test] * [HTTP/2] [1] [:path: /] * [HTTP/2] [1] [user-agent: curl/8.4.0] * [HTTP/2] [1] [accept: */*] * Connection #0 to host app.test left intact
Hey @balu-lt -- Your issue is a separate issue, which means your cert expired. You should be able run valet renew
to get back into a working state. Additionally, you can run valet secured
to see a list of all secured sites and their expiration dates. If prompted for typing in your password for the Keychain Access prompt, be sure to approve it so it can trust the CA. This is only required once after upgrading to Valet 4.7.0 or later. Before 4.7.0, you would have needed to type in your password for every new cert.
Note: I also found out the hard way Valet certs expire and wanted to add visibility to this via https://github.com/laravel/valet/pull/1461, which introduces the valet secured
command.
Hey @rabol After upgrading to Valet 4.7.1, did you try running valet renew
, valet secure
, or valet install
? This is required, as it will add the CA to your macOS Keychain Access store if needed.
The valet trust
command does not impact removing the password requirement when interacting with the keychain. That's only there for sudo
related tasks like restarting services on privileged ports like NGINX and dnsmasq. You should see the GUI prompt as shown in my previous message.
Just for good measure, can you run the following commands?
valet -V
valet unsecure
valet secure
security verify-cert -c ~/.config/valet/CA/LaravelValetCASelfSigned.pem
openssl verify -CAfile ~/.config/valet/CA/LaravelValetCASelfSigned.pem ~/.config/valet/Certificates/app.test.crt
curl --insecure -vvI https://app.test 2>&1 | awk 'BEGIN { cert=0 } /^\* SSL connection/ { cert=1 } /^\*/ { if (cert) print }'
Additionally, you should see this in the Keychain Access app.
Please post the output after running these commands.
You should see something like the following:
austin@austins-Virtual-Machine ~ % valet -V
Password:
Laravel Valet 4.7.1
austin@austins-Virtual-Machine app % valet unsecure
Restarting nginx...
The [app.test] site will now serve traffic over HTTP.
austin@austins-Virtual-Machine app % valet secure
Restarting nginx...
The [app.test] site has been secured with a fresh TLS certificate.
austin@austins-Virtual-Machine app % security verify-cert -c ~/.config/valet/CA/LaravelValetCASelfSigned.pem
...certificate verification successful.
austin@austins-Virtual-Machine app % security verify-cert -c ~/.config/valet/Certificates/app.test.crt
...certificate verification successful.
austin@austins-Virtual-Machine app % openssl verify -CAfile ~/.config/valet/CA/LaravelValetCASelfSigned.pem ~/.config/valet/Certificates/app.test.crt
/Users/austin/.config/valet/Certificates/app.test.crt: OK
austin@austins-Virtual-Machine app % curl --insecure -vvI https://app.test 2>&1 | awk 'BEGIN { cert=0 } /^\* SSL connection/ { cert=1 } /^\*/ { if (cert) print }'
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF
* ALPN: server accepted h2
* Server certificate:
* subject: CN=app.test; emailAddress=app.test@laravel.valet
* start date: Jun 27 23:17:09 2024 GMT
* expire date: Jun 30 23:17:09 2025 GMT
* issuer: O=Laravel Valet CA Self Signed Organization; CN=Laravel Valet CA Self Signed CN; OU=Developers; emailAddress=rootcertificate@laravel.valet
* SSL certificate verify ok.
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://app.test/
* [HTTP/2] [1] [:method: HEAD]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: app.test]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.6.0]
* [HTTP/2] [1] [accept: */*]
* Connection #0 to host app.test left intact
If it still isn't working, I suggest rebooting your machine to ensure a rouge NGINX process isn't around with old certs being served.
@adrum I think I have done all combinations of secure/unsecure, renew :)
and I would like to point out - one more time - that I am not prompted for password, after running the valet trust command.
Right now i have done:
valet unsecure --all
valet uninstall
reboot machine
then:
valet install
go to my app folder
valet secure
same error
reboot machine same error
if I open the site in firefox I get another error
Error code: SEC_ERROR_BAD_SIGNATURE
output of commands:
app valet -V
Laravel Valet 4.7.1
app valet unsecure
Restarting nginx...
The [app.test] site will now serve traffic over HTTP.
alet secure
Restarting nginx...
The [app.test] site has been secured with a fresh TLS certificate.
security verify-cert -c ~/.config/valet/CA/LaravelValetCASelfSigned.pem
...certificate verification successful.
app openssl verify -CAfile ~/.config/valet/CA/LaravelValetCASelfSigned.pem ~/.config/valet/Certificates/app.test.crt
/Users/rabol/.config/valet/Certificates/app.test.crt: OK
app openssl verify -CAfile ~/.config/valet/CA/LaravelValetCASelfSigned.pem ~/.config/valet/Certificates/app.test.crt
/Users/rabol/.config/valet/Certificates/app.test.crt: OK
➜ app curl --insecure -vvI https://app.test 2>&1 | awk 'BEGIN { cert=0 } /^\* SSL connection/ { cert=1 } /^\*/ { if (cert) print }'
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF
* ALPN: server accepted h2
* Server certificate:
* subject: CN=app.test; emailAddress=app.test@laravel.valet
* start date: Jun 28 03:57:35 2024 GMT
* expire date: Jul 1 03:57:35 2025 GMT
* issuer: O=Laravel Valet CA Self Signed Organization; CN=Laravel Valet CA Self Signed CN; OU=Developers; emailAddress=rootcertificate@laravel.valet
* SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://app.test/
* [HTTP/2] [1] [:method: HEAD]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: app.test]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.6.0]
* [HTTP/2] [1] [accept: */*]
* Connection #0 to host app.test left intact
What I have noticed that in your screenshot of the keychain, the certificate is in the 'login' section, mine is in the system section
I have not tried to do valet uninstall and the remove the certificate files and remove the certificate from keychain
Hey @rabol, Thank you for sending that back. My certificate is actually in the System, too. It's indicated in the last column in the table. It appears searching the Login keychain will also pull in matching System items.
Can you try this next?
sudo security delete-certificate -c "Laravel Valet CA Self Signed CN" /Library/Keychains/System.keychain
-- This will remove the cert from your System Keychain.sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ~/.config/valet/CA/LaravelValetCASelfSigned.pem
-- This will add it backvalet unsecure
valet secure
You should be prompted in the GUI on step 3.
Eureka!!
Now it works - thanks a lot.
Glad this was solved, thanks all 👍
I ran into the same issue, solved it by uninstalling all the certificates, renaming the CA folder and renewing all:
valet unsecure --all
mv ~/.config/valet/CA/ ~/.config/valet/CA.bak
Description
I have just installed the latest version of Valet
I then did a
Valet install
and now I get this error on all .test sitesNET::ERR_CERT_AUTHORITY_INVALID
Steps To Reproduce
install v 4.7.0 do a valet install
It will then renew all certificates
Diagnosis
sw_vers
valet --version
cat ~/.config/valet/config.json
cat ~/.composer/composer.json
composer global diagnose
composer global outdated
ls -al /etc/sudoers.d/
brew config
brew services list
brew list --formula --versions | grep -E "(php|nginx|dnsmasq|mariadb|mysql|mailhog|openssl)(@\d\..*)?\s"
brew outdated
brew tap
php -v
which -a php
php --ini
nginx -v
curl --version
php --ri curl
/opt/homebrew/bin/ngrok version
ls -al ~/.ngrok2
brew info nginx
brew info php
brew info openssl
openssl version -a
openssl ciphers
sudo nginx -t
which -a php-fpm
/opt/homebrew/opt/php/sbin/php-fpm -v
sudo /opt/homebrew/opt/php/sbin/php-fpm -y /opt/homebrew/etc/php/8.3/php-fpm.conf --test
ls -al ~/Library/LaunchAgents | grep homebrew
ls -al /Library/LaunchAgents | grep homebrew
ls -al /Library/LaunchDaemons | grep homebrew
ls -al /Library/LaunchDaemons | grep "com.laravel.valet."
ls -aln /etc/resolv.conf
cat /etc/resolv.conf
ifconfig lo0
sh -c 'echo "------\n/opt/homebrew/etc/nginx/valet/valet.conf\n---\n"; cat /opt/homebrew/etc/nginx/valet/valet.conf | grep -n "# valet loopback"; echo "\n------\n"'
sh -c 'for file in ~/.config/valet/dnsmasq.d/*; do echo "------\n~/.config/valet/dnsmasq.d/$(basename $file)\n---\n"; cat $file; echo "\n------\n"; done'
sh -c 'for file in ~/.config/valet/nginx/*; do echo "------\n~/.config/valet/nginx/$(basename $file)\n---\n"; cat $file | grep -n "# valet loopback"; echo "\n------\n"; done'