bugGNU Wget - Bugs: bug #58097, Wget doesn't download intermediate...


bug #58097: Wget doesn't download intermediate certificates when not supplied in the response

Submitter:  None
Submitted:  Wed 01 Apr 2020 11:48:34 PM UTC
Category:  Feature Request Severity:  3 - Normal
Priority:  5 - Normal Status:  Confirmed
Privacy:  Public Assigned to:  None
Originator Name:  Michael Clark Originator Email:  -email is unavailable-
Open/Closed:  Open Release:  1.20
Operating System:  GNU/Linux Reproducibility:  Every Time
Fixed Release:  None Planned Release:  None
Regression:  No Work Required:  None
Patch Included:  No
* Mandatory Fields

Add a New Comment Rich Markup

Wed 06 May 2020 07:12:45 PM UTC, comment #2: 

Just for the record, I think I'm experiencing this same issue implementing the OpenSSL backend in wget2. As soon as I discover how to solve it there I could back-port the fix to wget.

Ander Juaristi <ajuaristi>
Fri 03 Apr 2020 04:08:16 PM UTC, comment #1: 

Thanks for the hint.
Just opened https://gitlab.com/gnutls/gnutls/-/issues/968

Tim Ruehsen <rockdaboot>
Group administrator
Wed 01 Apr 2020 11:48:34 PM UTC, original submission:  

When using `wget` to connect to an Apache server which I believe lacks the `SSLCertificateChainFire` directive (www.xocolatl.com; I've contacted the server administrator to request a fix, so might not work indefinitely) using a Let's Encrypt certificate, `wget` reports (from running `wget https://www.xocolatl.com/`):

> ERROR: The certificate of ‘www.xocolatl.com’ is not trusted.                                                                                                              
> ERROR: The certificate of ‘www.xocolatl.com’ doesn't have a known issuer.

The site works fine in Chrome on Linux, and other sites using Let's Encrypt certificates work fine on my machine using `wget`. https://www.ssllabs.com/ssltest/analyze.html?d=www.xocolatl.com&s= shows that the intermediate certificate requires an extra download, and https://discussions.qualys.com/thread/12098 reports essentially the same issue.

What I expected: `wget` would connect to the server and get the page as usual, as works in my browser.

Can we make `wget` do the same as browsers, and fetch intermediate certificates? How difficult would that be?



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #48730:  wget-d-xocolatl.com.txt added by None (776B - text/plain - Debug output)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by ajuaristi (Posted a comment)
  • -email is unavailable- added by rockdaboot (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-04-03 rockdaboot StatusNone Confirmed
    2020-04-01 None Attached File- Added wget-d-xocolatl.com.txt, #48730

    Back to the top

    Powered by Savane 3.12.
    Corresponding source code