mancha wrote:
L Walsh <wget <at> tlinx.org> writes:
I recently started using 1.14 of wget included with my distro's updates:
GNU Wget 1.14 built on linux-gnu.
Trouble is, it gives security warnings on almost every https
site I access.
I can't think of 1 where I didn't have to override the security
warning (and this time, I just put it in my .wgetrc file).
So why does wget get all these errors when my browsers don't?
It appears your wget is built against the openssl library. For https
certificate verification to work in wget automagically as it does in
the major browsers, openssl needs a properly configured root
certificate store (default location: /etc/ssl/certs).
----
I have the latest ca-certificates for opensuse 13.1 installed:
rpm -ql ca-certificates
/etc/ca-certificates
/etc/ca-certificates/update.d
/etc/pki
/etc/pki/trust
/etc/pki/trust/anchors
/etc/pki/trust/blacklist
/etc/ssl/ca-bundle.pem
/etc/ssl/certs
/usr/lib/ca-certificates
/usr/lib/ca-certificates/update.d
/usr/lib/ca-certificates/update.d/certbundle.run
/usr/lib/ca-certificates/update.d/etc_ssl.run
/usr/lib/ca-certificates/update.d/java.run
/usr/lib/ca-certificates/update.d/openssl.run
/usr/sbin/update-ca-certificates
/usr/share/doc/packages/ca-certificates
/usr/share/doc/packages/ca-certificates/COPYING
/usr/share/doc/packages/ca-certificates/README
/usr/share/man/man8/update-ca-certificates.8.gz
/usr/share/pki
/usr/share/pki/trust
/usr/share/pki/trust/anchors
/usr/share/pki/trust/blacklist
/var/lib/ca-certificates
/var/lib/ca-certificates/ca-bundle.pem
/var/lib/ca-certificates/java-cacerts
/var/lib/ca-certificates/openssl
/var/lib/ca-certificates/pem
------------------
It shows files in /etc/ssl as well as other places.
But at the end of the update script, I notice a message:
if ($foundignored)
{
print STDERR "\n* = CA Certificates in /etc/ssl/certs are only seen by some
legacy applications.
To install CA-Certificates globally move them to /etc/pki/trust/ancors
instead!\n";
}
Perhaps wget isn't using the new location?
Check your distrib's documentation/support forums/mailing lists
for how to set this up. It might be a package that you can easily
install (for example, Debian and derivatives call theirs
"ca-certificates").
This is not a wget issue proper.
--mancha
