brew: SSL error when downloading from homebrew.bintray.com

As a temporary workaround, I’ve found adding this to your /etc/hosts works: 54.188.157.32 homebrew.bintray.com

It looks like the bintray subdomains are all now CNAMEs to jfrog.com without valid certificates, so CloudFront drops the connection. This IP is one that was found on a bintray.com subdomain a few days ago:

As a workaround, you may temporarily use HOMEBREW_BOTTLE_DOMAIN=https://dl.bintray.com/homebrew (don’t do this permanently or you’ll have issues when we switch over from Bintray in the coming weeks)

I don’t suppose Homebrew has an option for ignoring SSL errors?

Personally, I’d rather wait for the issue to be resolved than to ignore the security provided by SSL.

Hi, how can I do that?

export HOMEBREW_BOTTLE_DOMAIN=https://dl.bintray.com/homebrew

Confirmed; it seems to be fixed.

For Linux, the URL should contain linuxbrew instead of homebrew.

I’m hearing reports that this is starting to work for people without any workaround (just as I was considering releasing a workaround update!). Does it work for anyone now?

Give this comment 👍 or a 👎 if it’s now working or not working for you without the workaround.

@Bo98 It does indeed look like Bintray’s fixed their DNS. Works for me without any workaround now.

;; ANSWER SECTION:
homebrew.bintray.com.	59	IN	CNAME	dl.bintray.com.
dl.bintray.com.		59	IN	A	54.68.82.35
dl.bintray.com.		59	IN	A	52.27.102.247
dl.bintray.com.		59	IN	A	52.41.162.188
dl.bintray.com.		59	IN	A	52.24.200.146
dl.bintray.com.		59	IN	A	52.32.87.245
dl.bintray.com.		59	IN	A	44.239.142.179
dl.bintray.com.		59	IN	A	44.229.253.11
dl.bintray.com.		59	IN	A	52.36.31.250

Hi, how can I do that?

export HOMEBREW_BOTTLE_DOMAIN=https://dl.bintray.com/homebrew

or inline

HOMEBREW_BOTTLE_DOMAIN=https://dl.bintray.com/homebrew brew upgrade

Responding to this issue with “Me too!” without any additional context is not useful. Please use the 👍 button on the original message (and the subscribe button if you want to be notified about comments) unless you have something meaningful to add that could help in fixing this issue.

Glad I found this, reinstalled brew and all. Now I know it’s just not me. US-West (California).

The remote end is not speaking SSL: it’s speaking in plain text. Check http://homebrew.bintray.com:443/ with a browser.

No, that happens in May. This is just an outage - and seemingly one only affecting certain regions.

Solution for Chinese users

Well if you are using Tuna (Like many other developers in China), you can use the bottles from tsinghua university or other mirrors:

https://mirrors.tuna.tsinghua.edu.cn/help/homebrew/

if [[ "$(uname -s)" == "Linux" ]]; then BREW_TYPE="linuxbrew"; else BREW_TYPE="homebrew"; fi
export HOMEBREW_BREW_GIT_REMOTE="https://mirrors.tuna.tsinghua.edu.cn/git/homebrew/brew.git"
export HOMEBREW_CORE_GIT_REMOTE="https://mirrors.tuna.tsinghua.edu.cn/git/homebrew/${BREW_TYPE}-core.git"
export HOMEBREW_BOTTLE_DOMAIN="https://mirrors.tuna.tsinghua.edu.cn/${BREW_TYPE}-bottles"

=>

penguin@Penguins-MacBook-Pro ~ % brew install openssl                  
==> Downloading https://mirrors.tuna.tsinghua.edu.cn/homebrew-bottles/bottles/op
######################################################################## 100.0%
==> Pouring openssl@1.1-1.1.1j.big_sur.bottle.tar.gz
==> Caveats
A CA file has been bootstrapped using certificates from the system
keychain. To add additional certificates, place .pem files in
  /usr/local/etc/openssl@1.1/certs

and run
  /usr/local/opt/openssl@1.1/bin/c_rehash

openssl@1.1 is keg-only, which means it was not symlinked into /usr/local,
because macOS provides LibreSSL.

If you need to have openssl@1.1 first in your PATH, run:
  echo 'export PATH="/usr/local/opt/openssl@1.1/bin:$PATH"' >> ~/.zshrc

For compilers to find openssl@1.1 you may need to set:
  export LDFLAGS="-L/usr/local/opt/openssl@1.1/lib"
  export CPPFLAGS="-I/usr/local/opt/openssl@1.1/include"

For pkg-config to find openssl@1.1 you may need to set:
  export PKG_CONFIG_PATH="/usr/local/opt/openssl@1.1/lib/pkgconfig"

==> Summary
🍺  /usr/local/Cellar/openssl@1.1/1.1.1j: 8,071 files, 18.5MB
Removing: /usr/local/Cellar/openssl@1.1/1.1.1g... (8,059 files, 18MB)
Removing: /usr/local/Cellar/openssl@1.1/1.1.1h... (8,067 files, 18.5MB)
Removing: /Users/penguin/Library/Caches/Homebrew/openssl@1.1--1.1.1i.big_sur.bottle.tar.gz... (5.4MB)

This seems to be more the CDN can’t connect to the server. If you do just go to http://homebrew.bintray.com/ (no https) with a browser, you will get an error from the CDN of

403 ERROR The request could not be satisfied. Bad request. We can’t connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner. If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation. Generated by cloudfront (CloudFront) Request ID: 6DYVF26w8y8gGxPhclHORfebbB4aehGPr1rGG7eLRqzsCvjO8QD75Q==

It seems to be a server-side cert error, so I don’t think a local toggle will help.

Same issue on GitHub actions.

brew install libjwt
/bin/bash --noprofile --norc -eo pipefail /tmp/knicknic/os-specific-run/412a92a6-9412-4c03-b5b4-b63794aa3deb
==> Downloading https://homebrew.bintray.com/bottles/jansson-2.13.1.catalina.bottle.tar.gz
curl: (35) error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number
Error: Failed to download resource "jansson"
Download failed: https://homebrew.bintray.com/bottles/jansson-2.13.1.catalina.bottle.tar.gz
Warning: Bottle installation failed: building from source.
==> Downloading https://digip.org/jansson/releases/jansson-2.13.1.tar.gz
==> Downloading https://homebrew.bintray.com/bottles/libjwt-1.12.1.catalina.bottle.tar.gz
curl: (35) error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number
Error: Failed to download resource "libjwt"
Download failed: https://homebrew.bintray.com/bottles/libjwt-1.12.1.catalina.bottle.tar.gz
Warning: Bottle installation failed: building from source.
==> Downloading https://homebrew.bintray.com/bottles/automake-1.16.3.catalina.bottle.tar.gz
curl: (35) error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number
Error: Failed to download resource "automake"
Download failed: https://homebrew.bintray.com/bottles/automake-1.16.3.catalina.bottle.tar.gz
Warning: Bottle installation failed: building from source.
==> Downloading https://git.savannah.gnu.org/cgit/config.git/snapshot/config-0b5188819ba6091770064adf26360b204113317e.tar.gz
curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to git.savannah.gnu.org:443 
Error: Failed to download resource "automake--config"
Download failed: https://git.savannah.gnu.org/cgit/config.git/snapshot/config-0b5188819ba6091770064adf26360b204113317e.tar.gz
Error: The process '/bin/bash' failed with exit code 1

Despite that, the bintray status page says everything is fine.

Could possibly be CDN related (Bintray use AWS Cloudfront). It is working fine for me in the UK.