Certificate Expired error when connecting to package.elm-lang.org via elm-json

[woochica]

I started to recieve "Failed to fetch versions from package.elm-lang.org" errors when running elm-json.

❯ /elm-json -vv solve
phase: retrieve
 Nov 22 16:41:31.931 DEBG Fetching versions since 0
 Nov 22 16:41:32.285 WARN Failed to fetch versions from package.elm-lang.org
phase: resolve
 Nov 22 16:41:32.287 INFO beginning dependency resolution
phase: retrieve
 Nov 22 16:41:32.287 DEBG Finding best version for package root with constraint 1.0.0
 Nov 22 16:41:32.293 DEBG Finding best version for package NoRedInk/elm-json-decode-pipeline with constraint 1.0.0
phase: resolve
 Nov 22 16:41:32.294 INFO Failed to add package NoRedInk/elm-json-decode-pipeline 1.0.0: Unknown package NoRedInk/elm-json-decode-pipeline
 Nov 22 16:41:32.294 INFO solve failed

-- NO VALID PACKAGE VERSION ----------------------------------------------------

Because NoRedInk/elm-json-decode-pipeline does not appear to exist and this
project depends on NoRedInk/elm-json-decode-pipeline 1.0.0, no valid set of
package versions could be found.

• I can connect to package.elm-lang.org in my browsers and other command line clients well
• I used Wireshark to understand what went wrong. I saw that the elm-json client got a Certificate Expired error.
• All other client softwares and Keychain Access showed a valid certificate though. It's only elm-json somehow that fails.
• I compiled elm-json on my computer to see if that makes any difference, but I still get the error.
• I even wrote my first Rust program to see if there's anything Rust specific here. I simply fetched the JSON and printed out to the console, and it worked.

[jfmengels]

@woochica Some other Elm users have noticed a similar problem, which turned out to be their version of their Mac not supporting these certificates anymore (or something like that, my memory is a bit fuzzy).

I am unclear as to why it only happens with elm-json (and I imagine a select number of other tools), but basically a solution is to upgrade the version of your Mac installation. That has worked well for people that have tried it and reported back.

If you are not on a Mac, then I don't know what the issue is.

[woochica]

@jfmengels Good to know, thanks for sharing it. Can I read more about these cases somewhere? I'm on OSX and I'm curious about the affected versions. I have 10.14, and I'm aware that older versions can have certificate issues. It's also strange why I encounter this problem with this very specific software only.

[woochica]

I found the problem and a solution. It was indeed an OSX specific issue (Mojave affected). I came across a StackOverflow post where they described that very likely /etc/ssl/cert.pem contains the expired root cert. I could confirm that this was the case on my computer by running curl -v https://package.elm-lang.org 2>&1 | grep CAfile. Then simply by removing it from the cert file, it all works again.

[jfmengels]

@woochica I don't have more information. It was mostly shared on the Elm Slack and I think the history of that conversation disappeared already.

I'm glad you found the way to solve your issue though, and thanks for showing a workaround (that doesn't require upgrading your entire Mac) :pray: