DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:message-id:date:from:mime-version:to:subject
	:content-type:content-transfer-encoding; q=dns; s=default; b=CZj
	rGv/Uaru/StcUalh4NYQ7R7cFnPH4nZrfEHu5SAZBaYUtxHpX8afmJJiouq5SFxZ
	6argbROAzdjJp7X1QZXHLHsL5w45unn3GMAbgUo+6Ye+TSYrmLI5yjCpJyI5TRCE
	RuLqGv7+xYIgDVWm9twRO4ls5H6vdd/6bxSnmesY=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Message-ID: <52306A1F.706@gmail.com>
Date: Wed, 11 Sep 2013 22:03:27 +0900
From: nu774 <honeycomb77 AT gmail DOT com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130801 Thunderbird/17.0.8
MIME-Version: 1.0
To: cygwin AT cygwin DOT com
Subject: wget, OpenSSL and root CA certificates
Content-Type: text/plain; charset=ISO-2022-JP
Content-Transfer-Encoding: 7bit

Currently, root CA certificates of Cygwin are installed via
ca-certificates package, and at least libcurl sees it.
However, wget on https URL always results in verify error, since wget
relies on SSL_CTX_set_default_verify_paths() of OpenSSL, but OpenSSL
doesn't see certificates installed via ca-certificate package.

As far as I can see (using strings cygcrypto-1.0.0.dll | grep or
something), default store file for OpenSSL is configured as
/usr/ssl/cert.pem and directory is /usr/ssl/certs/.
Therefore I tried
ln -s /usr/ssl/certs/ca-bundle.crt /usr/ssl/cert.pem
and it works. Now I can use wget without --no-check-certificate.

Is it possible to link ca-bundle.crt to /usr/ssl/cert.pem like above on
ca-certificates package installation?

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple