3

Centos 6. After updating recently ca-certificates I run into some troubles. I have the most recent versions of curl for centos 6:

-bash-4.1$ curl -V -v
curl 7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
Protocols: tftp ftp telnet dict ldap ldaps http file https ftps scp sftp 
Features: GSS-Negotiate IDN IPv6 Largefile NTLM SSL libz 

And wget:

-bash-4.1$ wget -V -v
GNU Wget 1.12 built on linux-gnu.

+digest +ipv6 +nls +ntlm +opie +md5/openssl +https -gnutls +openssl 
-iri 

Wgetrc: 
    /etc/wgetrc (system)
Locale: /usr/share/locale 
Compile: gcc -DHAVE_CONFIG_H -DSYSTEM_WGETRC="/etc/wgetrc" 
    -DLOCALEDIR="/usr/share/locale" -I. -I../lib -O2 -g -pipe -Wall 
    -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector 
    --param=ssp-buffer-size=4 -m64 -mtune=generic -fno-strict-aliasing 
Link: gcc -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions 
    -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic 
    -fno-strict-aliasing -Wl,-z,relro -lssl -lcrypto 
    /usr/lib64/libssl.so /usr/lib64/libcrypto.so -ldl -lrt ftp-opie.o 
    openssl.o http-ntlm.o gen-md5.o ../lib/libgnu.a 

Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://www.gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Originally written by Hrvoje Niksic <hniksic@xemacs.org>.
Currently maintained by Micah Cowan <micah@cowan.name>.
Please send bug reports and questions to <bug-wget@gnu.org>.

Now I have problem with certificates from CA https://www.certum.pl/ . curl works fine:

-bash-4.1$ curl -v 'https://certum.pl/'
* About to connect() to certum.pl port 443 (#0)
*   Trying 213.222.201.147... connected
* Connected to certum.pl (213.222.201.147) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSL connection using TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* Server certificate:
*       subject: CN=certum.pl,businessCategory=Private Organization,serialNumber=0000421310,incorporationState=pomorskie,incorporationLocality=Gdańsk,incorporationCountry=PL,postalCode=81-321,STREET=Podolska 21,ST=pomorskie,L=Gdynia,OU=Certification Authority Division,O=Asseco Data Systems S.A.,C=PL
*       start date: Aug 16 09:10:07 2017 GMT
*       expire date: Aug 16 09:10:07 2019 GMT
*       common name: certum.pl
*       issuer: CN=Certum Extended Validation CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
> GET / HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: certum.pl
> Accept: */*
> 
< HTTP/1.1 302 Found
< Date: Tue, 17 Jul 2018 07:02:41 GMT
< Server: Apache
< Pragma: no-cache
< Location: https://www.certum.pl/pl/
< Content-Length: 209
< Connection: close
< Content-Type: text/html; charset=iso-8859-1
< 
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="https://www.certum.pl/pl/">here</a>.</p>
</body></html>
* Closing connection #0

But wget returns ERROR:

-bash-4.1$ wget -d -O-  'https://certum.pl/'
Setting --output-document (outputdocument) to -
DEBUG output created by Wget 1.12 on linux-gnu.

--2018-07-17 09:04:42--  https://certum.pl/
Resolving certum.pl... 213.222.201.147
Caching certum.pl => 213.222.201.147
Connecting to certum.pl|213.222.201.147|:443... connected.
Created socket 3.
Releasing 0x0000000000d2af00 (new refcount 1).
Initiating SSL handshake.
Handshake successful; connected socket 3 to SSL handle 0x0000000000d4bb40
certificate:
  subject: /C=PL/O=Asseco Data Systems S.A./OU=Certification Authority Division/L=Gdynia/ST=pomorskie/street=Podolska 21/postalCode=81-321/1.3.6.1.4.1.311.60.2.1.3=PL/1.3.6.1.4.1.311.60.2.1.1=Gda\\xC5\\x84sk/1.3.6.1.4.1.311.60.2.1.2=pomorskie/serialNumber=0000421310/businessCategory=Private Organization/CN=certum.pl
  issuer:  /C=PL/O=Unizeto Technologies S.A./OU=Certum Certification Authority/CN=Certum Extended Validation CA SHA2
ERROR: cannot verify certum.pl's certificate, issued by `/C=PL/O=Unizeto Technologies S.A./OU=Certum Certification Authority/CN=Certum Extended Validation CA SHA2':
  Unable to locally verify the issuer's authority.
To connect to certum.pl insecurely, use `--no-check-certificate'.
Closed 3/SSL 0x0000000000d4bb40

The same happens when I specify CA certificates in the command - for wget: --ca-certificate=/etc/pki/tls/certs/ca-bundle.crt and for curl: --cacert /etc/pki/tls/certs/ca-bundle.crt

The ca-certificates version is now 2018.2.22-65.1.el6 - the newest. The openssl version is now 1.0.1e-57.el6 - the newest.

Do you have any idea what is happening?

  • Wget 1.12 is a very old version of Wget and it was probably compiled against a very old version of OpenSSL. – Dmitri Chubarov Jul 17 '18 at 7:39
  • Probably you're right. But everything was ok, until I updated ca-certificates on 2018-07-12. Only after this update I got problems. So I don't know. – keypress Jul 17 '18 at 7:53
6

wget is linked to OpenSSL whereas curl is linked to the NSS cryptographic libraries, which likely explains why they use different trust stores.

I don't have a RHEL 6 system nearby but probably rpm -ql nss will show a different/additional trust store compared to what OpenSSL uses.

This Red Hat resource may be of relevance https://access.redhat.com/solutions/1549003

In short: update-ca-trust extract

  • I tried this, but there is no change: still curl is working and wget is not. Interesting that svn has the same problem. – keypress Jul 17 '18 at 10:53
0

My working solution for this problem with Centos 6 is to add the "missing" CA certificate to trust store managed by ca-certificates. I don't know why they removed it in that update. So:

  1. Copy the root CA certificate from page "https://certum.pl/" to /etc/pki/ca-trust/source/anchors/
  2. Execute: update-ca-trust enable
  3. Execute: update-ca-trust extract

Still I don't know fully why wget wasn't working and curl was. When I tried rpm -ql nss, there was no information about any other trust store. I don't know where it can be located.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.