Hi Karl,
Karl Berry <[email protected]> writes: > With wget 1.17 (at least), > > $ wget -nv --no-check-cert https://www.gnu.org -O /dev/null > WARNING: cannot verify www.gnu.org's certificate, issued by 'CN=Gandi > Standard SSL CA 2,O=Gandi,L=Paris,ST=Paris,C=FR': > Unable to locally verify the issuer's authority. > > Maybe I'm crazy, but it seems like pointless noise to complain that a > certificate cannot be verified when wget has been explicitly told not to > check it. Looking at the source, the only way I see to get rid of the > warning is with --silent, which would also eliminate real errors. the only difference with --no-check-cert is that wget will fail and exit immediately when the certificate is not valid. The idea behind --no-check-cert was probably to not abort the execution of wget but still inform the user about an invalid certificate, as the documentation says: This option forces an ``insecure'' mode of operation that turns the certificate verification errors into warnings and allows you to proceed. I am personally in favor of dropping the warning, as it is doing something the user asked to not do. Anybody has something against this patch? Regards, Giuseppe diff --git a/doc/wget.texi b/doc/wget.texi index c647e33..6aeda72 100644 --- a/doc/wget.texi +++ b/doc/wget.texi @@ -1714,9 +1714,7 @@ handshake and aborting the download if the verification fails. Although this provides more secure downloads, it does break interoperability with some sites that worked with previous Wget versions, particularly those using self-signed, expired, or otherwise -invalid certificates. This option forces an ``insecure'' mode of -operation that turns the certificate verification errors into warnings -and allows you to proceed. +invalid certificates. If you encounter ``certificate verification'' errors or ones saying that ``common name doesn't match requested host name'', you can use diff --git a/src/gnutls.c b/src/gnutls.c index d1444fe..b48e4e8 100644 --- a/src/gnutls.c +++ b/src/gnutls.c @@ -686,12 +686,13 @@ ssl_check_certificate (int fd, const char *host) unsigned int status; int err; - - /* If the user has specified --no-check-cert, we still want to warn - him about problems with the server's certificate. */ - const char *severity = opt.check_cert ? _("ERROR") : _("WARNING"); + const char *severity = _("ERROR"); bool success = true; + /* The user explicitly said to not check for the certificate. */ + if (!opt.check_cert) + return success; + err = gnutls_certificate_verify_peers2 (ctx->session, &status); if (err < 0) { @@ -766,5 +767,5 @@ ssl_check_certificate (int fd, const char *host) } out: - return opt.check_cert ? success : true; + return success; } diff --git a/src/openssl.c b/src/openssl.c index 4876048..f5fe675 100644 --- a/src/openssl.c +++ b/src/openssl.c @@ -673,15 +673,15 @@ ssl_check_certificate (int fd, const char *host) long vresult; bool success = true; bool alt_name_checked = false; - - /* If the user has specified --no-check-cert, we still want to warn - him about problems with the server's certificate. */ - const char *severity = opt.check_cert ? _("ERROR") : _("WARNING"); - + const char *severity = _("ERROR"); struct openssl_transport_context *ctx = fd_transport_context (fd); SSL *conn = ctx->conn; assert (conn != NULL); + /* The user explicitly said to not check for the certificate. */ + if (!opt.check_cert) + return success; + cert = SSL_get_peer_certificate (conn); if (!cert) { @@ -885,8 +885,7 @@ ssl_check_certificate (int fd, const char *host) To connect to %s insecurely, use `--no-check-certificate'.\n"), quotearg_style (escape_quoting_style, host)); - /* Allow --no-check-cert to disable certificate checking. */ - return opt.check_cert ? success : true; + return success; } /*
