Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a problem with my Fedora 8 installation. It looks that wget doesn't know how to verify SSL certificates any more. It's strange because I have another Fedora 8 box which I believe has the same configuration and it works!

How can I make it work without using "`--no-check-certificate" switch?

This is a sample output:

--2011-09-23 00:11:13--
Resolving,,, ...
Connecting to||:443... connected.
ERROR: cannot verify's certificate, issued by `/C=ZA/O=Thawte Consulting (Pty) Ltd./CN=Thawte SGC CA':
  Unable to locally verify the issuer's authority.
To connect to insecurely, use `--no-check-certificate'.
Unable to establish SSL connection.


I have this file /etc/pki/tls/certs/ca-bundle.crt file and when I run wget with --ca-certificate switch pointing to this file everything goes fine. Where should this file be placed so that I don't need to use the switch?

BTW: curl and links work fine, but lynx also complains: "SSL error:unable to get local issuer certificate" so this is not only wget's issue...

share|improve this question
Why do you even have a Fedora 8 installation? – Ignacio Vazquez-Abrams Sep 22 '11 at 23:27
Fedora 9, 10, 11, 12, and 13 aren't even supported anymore. – ceejayoz Sep 23 '11 at 1:50
I'm aware this is an ancient OS no longer supported but I hope that this is just some kind of a configuration problem which might be easily solved by someone experienced so that I don't need to upgrade the whole system. – tomazy Sep 23 '11 at 2:00
what is the version of wget you are using ? – SparX Sep 23 '11 at 2:07
GNU Wget 1.11.1 (Red Hat modified) – tomazy Sep 23 '11 at 2:58
up vote 9 down vote accepted

By default wget will check for certificates in the path defined in openssl conf file /etc/pki/tls/openssl.cnf (no sure whether the path is correct for fc8). Please check the openssl configuration file and confirm that the paths are correct. May be it is openssl, that need to be corrected.

share|improve this answer
It was a problem with openssl - cert.pem file was missing in /etc/pki/tls. Thanks – tomazy Sep 23 '11 at 3:08

Your system doesn't trust the signature chain for Google's cert.

They also aren't presenting the full certificate chain, just their issuer's certificate; not 100% up to par, but certainly nothing that should stop you from validating the chain.

Your ancient system is likely to have an equally ancient set of trusted root certificate authorities.

Trust the right VeriSign cert (here), and you should be good.

share|improve this answer
How exactly do I "trust" the VeriSign cert? – tomazy Sep 23 '11 at 1:39
Probably needs to be put in /etc/ssl/certs. – Shane Madden Sep 23 '11 at 1:51
This dir didn't exist but I created it and copied the cert files - it didn't help :( – tomazy Sep 23 '11 at 2:02
Not sure where the certificates directory is located in that OS, then. grep around! – Shane Madden Sep 23 '11 at 2:16

You need to gather a list of the root certificates that you wish to trust and tell wget how to find them using either the --ca-certificate or --ca-directory option. You may already have one in /etc/pki/tls/certs if you have the appropriate package installed.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.