Wget error the certificate of is not trusted

Russell DavisRussell Davis

8,1944 gold badges39 silver badges41 bronze badges

If you don’t care about checking the validity of the certificate just add the --no-check-certificate option on the wget command-line. This worked well for me.

NOTE: This opens you up to man-in-the-middle (MitM) attacks, and is not recommended for anything where you care about security.

Looking at current hacky solutions in here, I feel I have to describe a proper solution after all.

First, you need to install the cygwin package ca-certificates via Cygwin’s setup.exe to get the certificates.

Do NOT use curl or similar hacks to download certificates (as a neighboring answer advices) because that’s fundamentally insecure and may compromise the system.

Second, you need to tell wget where your certificates are, since it doesn’t pick them up by default in Cygwin environment. If you can do that either with the command-line parameter --ca-directory=/usr/ssl/certs (best for shell scripts) or by adding ca_directory = /usr/ssl/certs to ~/.wgetrc file.

You can also fix that by running ln -sT /usr/ssl /etc/ssl as pointed out in another answer, but that will work only if you have administrative access to the system. Other solutions I described do not require that.

answered Mar 6, 2013 at 16:26

If the problem is that a known root CA is missing and when you are using ubuntu or debian, then you can solve the problem with this one line:

sudo apt-get install ca-certificates

May be this will help:

wget --no-check-certificate https://blah-blah.tld/path/filename

First, the SSL certificates need to be installed. Instructions (based on https://stackoverflow.com/a/4454754/278488):

pushd /usr/ssl/certs
curl http://curl.haxx.se/ca/cacert.pem | awk 'split_after==1{n++;split_after=0} /-----END CERTIFICATE-----/ {split_after=1} {print > "cert" n ".pem"}'
c_rehash

The above is enough to fix curl, but wget requires an extra symlink:

ln -sT /usr/ssl /etc/ssl

apt-get install ca-certificates 

The s makes the difference

I have the similar problem and fixed it by temporarily disabling my antivirus(Kaspersky Free 18.0.0.405). This AV has HTTPS interception module that automatically self-sign all certificates it finds in HTTPS responses.

Wget from Cygwin does not know anything about AV root certificate, so when it finds that website’s certificate was signed with non trust certificate it prints that error.

To fix this permanently without disabling AV you should copy the AV root certificate from Windows certificate store to /etc/pki/ca-trust/source/anchors as .pem file(base64 encoding) and run update-ca-trust

answered Oct 28, 2018 at 23:15

Uncle IrohUncle Iroh

5,6626 gold badges49 silver badges61 bronze badges

viggy28viggy28

7109 silver badges21 bronze badges

answered Jul 29, 2017 at 6:50

answered Aug 20, 2014 at 3:13

asked Jan 4, 2017 at 22:00

If you are using Debian or Ubuntu, install the ca-certificates package:

$ sudo apt-get install ca-certificates

If you don’t care about checking the validity of the certificate, use the --no-check-certificate option:

$ wget --no-check-certificate https://download/url

Note: The second option is not recommended because of the possibility of a man-in-the-middle attack.

Per TFM for wget use the

--no-check-certificate

option.

«Don’t check the server certificate against the available certificate authorities. Also don’t require the URL host name to match the common name presented by the certificate.»

answered Jan 5, 2017 at 3:29

In my case, the root caused turned out to be an incorrect system date, which happened to be out of the certificate validity date range at the time of executing pip. This is related to the SSL library and not pip itself. Thus a simple wget or curl call to the offending URL will duplicate the issue.

Of course, I was also able to work around the issue quickly with —no-check—certificate (or equivalent) for wget and pip.

This might be a common case with working with SBC like RasberryPi/BeagleBone or any other system where a real-time clock (RTC) is not present out of the box. So lesson learned: Use NTP for to keep system time up-to-date whenever possible.

answered Jul 30, 2020 at 5:34

asked Jul 18, 2012 at 21:43

If you don’t care about checking the validity of the certificate just add the --no-check-certificate option on the wget command-line.

Edit:

Not checking the validity of the certificate opens you up to man-in-the-middle attacks (MiTM). Depending on the environment you’re working in (over the Internet vs. a private LAN) this could be a major vulnerability. Your situation and risk profile should inform your decision.

If you do actually care about checking the validity of the certificate you should provide wget with a CA certificate «bundle». Cygwin provides this in the «ca-certificates» package. You can find more specific details in this Stack Overflow answer. It looks like there has been little consensus as to the location of the SSL certificate bundle for Cygwin in the past, resulting in the need to specify its location in configuration files or create symlinks to direct applications to the appropriate directory. Your mileage will vary depending on the version of Cygwin tools you’re using.