DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:in-reply-to:references:from:date
	:message-id:subject:to:content-type:content-transfer-encoding;
	 q=dns; s=default; b=qAP5z1XmHFqAS4ZrxPRsQHxS2iIYZvoLrjh+5tx9OWw
	q9Ry2asvxh8E2ynwwa31Jro1X4OQ7JxP25HYfCMUUhukdxsGpj7GjkC0oo13fOpF
	mpALaWu2V/y1bX3yST+i0Dmef8800coDlWQFaA1+0WzI+3PYEq5Rw5WFajhULovo
	=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
MIME-Version: 1.0
In-Reply-To: <bd0e6b94-9286-9e42-0efa-6ce8a9e2bd8d@gmail.com>
References: <1964416456 DOT 20180805201253 AT yandex DOT ru> <bd0e6b94-9286-9e42-0efa-6ce8a9e2bd8d AT gmail DOT com>
From: Csaba Raduly <rcsaba AT gmail DOT com>
Date: Sun, 5 Aug 2018 22:03:24 +0200
Message-ID: <CAEhDDbCE6BN+Ok-NnAS9JhxXa6mC5NYqsyFUMhLS+jZuYoe9tw@mail.gmail.com>
Subject: Re: wget does not recognize PKI?
To: cygwin list <cygwin AT cygwin DOT com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit

On Sun, Aug 5, 2018 at 7:36 PM, Marco Atzeri  wrote:
> Am 05.08.2018 um 19:12 schrieb Andrey Repin:
>>
>> Greetings, All!
>>
>> $ wget https://ca.rootdir.org/ca.crl
>> --2018-08-05 20:05:28--  https://ca.rootdir.org/ca.crl
>> Resolving ca.rootdir.org (ca.rootdir.org)... 192.168.1.6
>> Connecting to ca.rootdir.org (ca.rootdir.org)|192.168.1.6|:443...
>> connected.
>> ERROR: The certificate of ‘ca.rootdir.org’ is not trusted.
>> ERROR: The certificate of ‘ca.rootdir.org’ hasn't got a known issuer.
>>
>
>>
>> What's going on?
>>
>
> It seems not a cygwin issue:
>
> "This connection is not secure
>
> The owner of ca.rootdir.org did not properly configure the site. Firefox has
> not affiliated with this site to protect your information from theft."
>

And not just Firefox :

$ curl -v https://ca.rootdir.org/ca.crl
* STATE: INIT => CONNECT handle 0x600057990; line 1404 (connection #-5000)
* Added connection 0. The cache now contains 1 members
* STATE: CONNECT => WAITRESOLVE handle 0x600057990; line 1440 (connection #0)
*   Trying 77.50.25.68...
* TCP_NODELAY set
* STATE: WAITRESOLVE => WAITCONNECT handle 0x600057990; line 1521
(connection #0)
* Connected to ca.rootdir.org (77.50.25.68) port 443 (#0)
* STATE: WAITCONNECT => SENDPROTOCONNECT handle 0x600057990; line 1573
(connection #0)
* Marked for [keep alive]: HTTP default
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
  CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* STATE: SENDPROTOCONNECT => PROTOCONNECT handle 0x600057990; line
1587 (connection #0)
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, Server hello (2):
* SSL certificate problem: self signed certificate in certificate chain
* Marked for [closure]: Failed HTTPS connection
* multi_done
* stopped the pause stream!
* Closing connection 0
* The cache now contains 0 members
* Expire cleared
curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.


Csaba
-- 
You can get very substantial performance improvements
by not doing the right thing. - Scott Meyers, An Effective C++11/14 Sampler
So if you're looking for a completely portable, 100% standards-conformat way
to get the wrong information: this is what you want. - Scott Meyers (C++TDaWYK)

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple