Wget chyba SSL spojení

[TommyAst]

Pri pouzivani wget mi nahle zacala vyskakovat chyba:

Kód: [Vybrat]

wget https://meteomodel.pl/synmap.gif
--2019-01-15 07:23:17--  https://meteomodel.pl/synmap.gif
Překládám meteomodel.pl (meteomodel.pl)… 52.47.174.116
Navazuje se spojení s meteomodel.pl (meteomodel.pl)|52.47.174.116|:443… spojeno.
GnuTLS: The TLS connection was non-properly terminated.
Nebylo možné navázat SSL spojení.

Oc muze jit ? Problemy se starsim wgetem, jiny certifikat ?

Prez curl to vypada, ze funguje (bez presmerovani vypise na obrazovku):

Kód: [Vybrat]

curl https://meteomodel.pl/synmap.gif >> synmap.gif


[Reklama]

[Petr Krčmář]

Za to můžou obvykle chybějící kořenové certifikáty v systému, v Debianu/Ubuntu se ten balíček jmenuje ca-certificates. Že to curlu nevadí, je zvláštní. Ale může mít kontrolu certifikátů potlačenou. Každopádně doporučuji zkontrolovat, jestli v systému ten balíček s autoritami je.

[JardaP .]

Pokud tim nestahujete nejaka supertajna data, na kterych zalezi preziti lidstva, na coz to nevypada, tak tam pridejte --no-check-certificate a melo by to asi jet.

[Jenda]

Selhání ověření certifikátu vypadá jinak. Já bych to tipoval na curl používající openssl, wget používající gnutls, a blbě nastavené gnutls. Co řekne "gnutls-cli meteomodel.pl 443"?

[Petr Klejch]

Mel jsme podobny problem na macOS, kde byl cURL zkompilovany se Secure Transport (https://developer.apple.com/documentation/security/secure_transport) a cURL nekdy vyhazoval chybu

Kód: [Vybrat]

SSLRead() return error -9806
Resenim bylo zkompilovat cURL s openssl.

[Reklama]

[Kato]

Koukněte do tcpdumpu na ClientHello zpravy, muzete i porovnat wget s curl.

Ja osobne tipuju, ze wget neposila server_name extension, zatimco curl ano. Potvrzuje to i test s openssl s_client:

Bez server_name:

# openssl s_client -connect meteomodel.pl:443
CONNECTED(00000003)
140599229896520:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:184:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 247 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---


S server_name:

# openssl s_client -connect meteomodel.pl:443 -servername meteomodel.pl
CONNECTED(00000003)
depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = meteomodel.pl
verify return:1
---
Certificate chain
 0 s:/CN=meteomodel.pl
   i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
 1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
   i:/O=Digital Signature Trust Co./CN=DST Root CA X3
---
Server certificate
-----BEGIN CERTIFICATE-----
...

[TommyAst]

Po aktualizaci certifikatu to funguje. Proste je tam nejaky novy certifikat, co wgetu chybeli.

Vypnuti overovani certifikatu take funguje.

Kód: [Vybrat]

gnutls-cli meteomodel.pl 443

Processed 152 CA certificate(s).
Resolving 'meteomodel.pl'...
Connecting to '52.47.194.223:443'...
- Certificate type: X.509
- Got a certificate list of 2 certificates.
- Certificate[0] info:
 - subject `CN=meteomodel.pl', issuer `C=US,O=Let's Encrypt,CN=Let's Encrypt Authority X3', RSA key 4096 bits, signed using RSA-SHA256, activated `2018
-12-06 01:52:49 UTC', expires `2019-03-06 01:52:49 UTC', SHA-1 fingerprint `26bd190c51ae6f4158ea8377e922c71aa93c6dec'
Public Key ID:
4814958946e50601169cf3036ce8b163d3aa1f36
Public key's random art:
+--[ RSA 4096]----+
|   ++=**oo       |
|  o.B.ooo        |
| . = =. o        |
|  * ..oo         |
| . +  ..S        |
|  .              |
| .E              |
|.. o             |
| ..              |
+-----------------+

- Certificate[1] info:
 - subject `C=US,O=Let's Encrypt,CN=Let's Encrypt Authority X3', issuer `O=Digital Signature Trust Co.,CN=DST Root CA X3', RSA key 2048 bits, signed us
ing RSA-SHA256, activated `2016-03-17 16:40:46 UTC', expires `2021-03-17 16:40:46 UTC', SHA-1 fingerprint `e6a3b45b062d509b3382282d196efe97d5956ccb'
- Status: The certificate is trusted.
- Description: (TLS1.2)-(ECDHE-RSA-SECP256R1)-(AES-128-GCM)
- Session ID: 8A:03:A9:39:0D:1E:D0:41:EF:D9:4B:AB:E0:5F:FF:1E:3C:5D:0F:2F:55:39:7C:C2:4B:B7:A2:1F:5B:E2:DE:6C
- Ephemeral EC Diffie-Hellman parameters
 - Using curve: SECP256R1
 - Curve size: 256 bits
- Version: TLS1.2
- Key Exchange: ECDHE-RSA
- Server Signature: RSA-SHA256
- Cipher: AES-128-GCM
- MAC: AEAD
- Compression: NULL
- Options: safe renegotiation,
- Handshake was completed

- Simple Client Mode: