bugGNU Wget - Bugs: bug #22767, private key is no longer read from...


bug #22767: private key is no longer read from the certificate file

Submitter:  Noël Köthe <nok>
Submitted:  Fri 28 Mar 2008 07:13:57 PM UTC
Category:  Program Logic Severity:  3 - Normal
Priority:  7 - High Status:  Fixed
Privacy:  Public Assigned to:  None
Originator Name:  Open/Closed:  Closed
Release:  1.10 Operating System:  None
Reproducibility:  None Fixed Release:  1.12
Planned Release:  1.12 Regression:  None
Work Required:  None Patch Included:  Yes
* Mandatory Fields

Add a New Comment Rich Markup

Wed 23 Apr 2008 06:31:16 AM UTC, comment #2: 

Fixed for mainline in 52d6a687a3c3.

Micah Cowan <micahcowan>
Wed 23 Apr 2008 06:28:06 AM UTC, comment #1: 

Looks like it was originally commented out in 710c20dec7b9, with a "what was this supposed to achieve?" comment, sometime before the filename change to openssl.c.

Micah Cowan <micahcowan>
Fri 28 Mar 2008 07:13:57 PM UTC, original submission:  


sorry for forwarding this patch with a long delay:

In wget versions prior to 1.10, specifying a SSL client certificate file that contained both the public and private key was sufficient:
  wget --certificate=foo.pem https://server/

With 1.10, it now needs the private key specified separately, even if it's in the same file:
  wget --certificate=foo.pem --private-key=foo.pem https://server/

>From the man page wget(1), it seems that the --private-key option is still intended to be required only when the private key is in a different file:

           Read the private key from file.  This allows you to provide
           the private key in a file separate from the certificate.

It looks like the behavior changed at the same time the SSL stuff was moved into openssl.c, so I suspect it was unintentional.  The below patch restores the previous behavior.


diff -purN wget-1.10.2+1.11.beta1.orig/src/openssl.c wget-1.10.2+1.11.beta1/src/openssl.c
--- wget-1.10.2+1.11.beta1.orig/src/openssl.c 2006-07-14 09:25:50.000000000 -0400
+++ wget-1.10.2+1.11.beta1/src/openssl.c 2007-05-23 16:23:56.000000000 -0400
@@ -210,6 +210,12 @@ ssl_init ()
      than examining the error stack after a failed SSL_connect.  */
   SSL_CTX_set_verify (ssl_ctx, SSL_VERIFY_NONE, NULL);
+  /* Use the private key from the cert file unless specified otherwise. */
+  if (opt.cert_file && !opt.private_key) {
+    opt.private_key = opt.cert_file;
+    opt.private_key_type = opt.cert_type;
+  }
   if (opt.cert_file)
     if (SSL_CTX_use_certificate_file (ssl_ctx, opt.cert_file,
        key_type_to_ssl_type (opt.cert_type))


Noël Köthe <nok>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by micahcowan (Updated the item)
  • -email is unavailable- added by nok (Submitted the item)

    Follow 9 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2008-04-23 micahcowan StatusIn Progress Fixed
        Open/ClosedOpen Closed
        Release1.11 1.10
        Fixed ReleaseNone 1.12
    2008-04-23 micahcowan StatusNeeds Investigation In Progress
    2008-04-14 micahcowan StatusNeeds Discussion Needs Investigation
    2008-03-28 micahcowan Priority5 - Normal 7 - High
        StatusNone Needs Discussion
        Planned ReleaseNone 1.12

    Back to the top

    Powered by Savane 3.12