Fri 28 Mar 2008 07:13:57 PM UTC, original submission:
Hello,
sorry for forwarding this patch with a long delay:
http://bugs.debian.org/425768
--8<--
In wget versions prior to 1.10, specifying a SSL client certificate file that contained both the public and private key was sufficient:
wget --certificate=foo.pem https://server/
With 1.10, it now needs the private key specified separately, even if it's in the same file:
wget --certificate=foo.pem --private-key=foo.pem https://server/
>From the man page wget(1), it seems that the --private-key option is still intended to be required only when the private key is in a different file:
--private-key=file
Read the private key from file. This allows you to provide
the private key in a file separate from the certificate.
It looks like the behavior changed at the same time the SSL stuff was moved into openssl.c, so I suspect it was unintentional. The below patch restores the previous behavior.
-jim
diff -purN wget-1.10.2+1.11.beta1.orig/src/openssl.c wget-1.10.2+1.11.beta1/src/openssl.c
--- wget-1.10.2+1.11.beta1.orig/src/openssl.c 2006-07-14 09:25:50.000000000 -0400
+++ wget-1.10.2+1.11.beta1/src/openssl.c 2007-05-23 16:23:56.000000000 -0400
@@ -210,6 +210,12 @@ ssl_init ()
than examining the error stack after a failed SSL_connect. */
SSL_CTX_set_verify (ssl_ctx, SSL_VERIFY_NONE, NULL);
+ /* Use the private key from the cert file unless specified otherwise. */
+ if (opt.cert_file && !opt.private_key) {
+ opt.private_key = opt.cert_file;
+ opt.private_key_type = opt.cert_type;
+ }
+
if (opt.cert_file)
if (SSL_CTX_use_certificate_file (ssl_ctx, opt.cert_file,
key_type_to_ssl_type (opt.cert_type))
--8<--
|