Why does curl work with a specific https site, but wget has problems with certificates?

Centos 6. After updating recently ca-certificates I run into some troubles. I have the most recent versions of curl for centos 6:

-bash-4.1$ curl -V -v
curl 7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
Protocols: tftp ftp telnet dict ldap ldaps http file https ftps scp sftp 
Features: GSS-Negotiate IDN IPv6 Largefile NTLM SSL libz

And wget:

-bash-4.1$ wget -V -v
GNU Wget 1.12 built on linux-gnu.

+digest +ipv6 +nls +ntlm +opie +md5/openssl +https -gnutls +openssl 
-iri 

Wgetrc: 
    /etc/wgetrc (system)
Locale: /usr/share/locale 
Compile: gcc -DHAVE_CONFIG_H -DSYSTEM_WGETRC="/etc/wgetrc" 
    -DLOCALEDIR="/usr/share/locale" -I. -I../lib -O2 -g -pipe -Wall 
    -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector 
    --param=ssp-buffer-size=4 -m64 -mtune=generic -fno-strict-aliasing 
Link: gcc -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions 
    -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic 
    -fno-strict-aliasing -Wl,-z,relro -lssl -lcrypto 
    /usr/lib64/libssl.so /usr/lib64/libcrypto.so -ldl -lrt ftp-opie.o 
    openssl.o http-ntlm.o gen-md5.o ../lib/libgnu.a 

Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://www.gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Originally written by Hrvoje Niksic <[email protected]>.
Currently maintained by Micah Cowan <[email protected]>.
Please send bug reports and questions to <[email protected]>.

Now I have problem with certificates from CA https://www.certum.pl/ . curl works fine:

-bash-4.1$ curl -v 'https://certum.pl/'
* About to connect() to certum.pl port 443 (#0)
*   Trying 213.222.201.147... connected
* Connected to certum.pl (213.222.201.147) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSL connection using TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* Server certificate:
*       subject: CN=certum.pl,businessCategory=Private Organization,serialNumber=0000421310,incorporationState=pomorskie,incorporationLocality=Gdańsk,incorporationCountry=PL,postalCode=81-321,STREET=Podolska 21,ST=pomorskie,L=Gdynia,OU=Certification Authority Division,O=Asseco Data Systems S.A.,C=PL
*       start date: Aug 16 09:10:07 2017 GMT
*       expire date: Aug 16 09:10:07 2019 GMT
*       common name: certum.pl
*       issuer: CN=Certum Extended Validation CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
> GET / HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: certum.pl
> Accept: */*
> 
< HTTP/1.1 302 Found
< Date: Tue, 17 Jul 2018 07:02:41 GMT
< Server: Apache
< Pragma: no-cache
< Location: https://www.certum.pl/pl/
< Content-Length: 209
< Connection: close
< Content-Type: text/html; charset=iso-8859-1
< 
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="https://www.certum.pl/pl/">here</a>.</p>
</body></html>
* Closing connection #0

But wget returns ERROR:

-bash-4.1$ wget -d -O-  'https://certum.pl/'
Setting --output-document (outputdocument) to -
DEBUG output created by Wget 1.12 on linux-gnu.

--2018-07-17 09:04:42--  https://certum.pl/
Resolving certum.pl... 213.222.201.147
Caching certum.pl => 213.222.201.147
Connecting to certum.pl|213.222.201.147|:443... connected.
Created socket 3.
Releasing 0x0000000000d2af00 (new refcount 1).
Initiating SSL handshake.
Handshake successful; connected socket 3 to SSL handle 0x0000000000d4bb40
certificate:
  subject: /C=PL/O=Asseco Data Systems S.A./OU=Certification Authority Division/L=Gdynia/ST=pomorskie/street=Podolska 21/postalCode=81-321/1.3.6.1.4.1.311.60.2.1.3=PL/1.3.6.1.4.1.311.60.2.1.1=Gda\\xC5\\x84sk/1.3.6.1.4.1.311.60.2.1.2=pomorskie/serialNumber=0000421310/businessCategory=Private Organization/CN=certum.pl
  issuer:  /C=PL/O=Unizeto Technologies S.A./OU=Certum Certification Authority/CN=Certum Extended Validation CA SHA2
ERROR: cannot verify certum.pl's certificate, issued by `/C=PL/O=Unizeto Technologies S.A./OU=Certum Certification Authority/CN=Certum Extended Validation CA SHA2':
  Unable to locally verify the issuer's authority.
To connect to certum.pl insecurely, use `--no-check-certificate'.
Closed 3/SSL 0x0000000000d4bb40

The same happens when I specify CA certificates in the command - for wget: --ca-certificate=/etc/pki/tls/certs/ca-bundle.crt and for curl: --cacert /etc/pki/tls/certs/ca-bundle.crt

The ca-certificates version is now 2018.2.22-65.1.el6 - the newest. The openssl version is now 1.0.1e-57.el6 - the newest.

Do you have any idea what is happening?

wget is linked to OpenSSL whereas curl is linked to the NSS cryptographic libraries, which likely explains why they use different trust stores.

I don't have a RHEL 6 system nearby but probably rpm -ql nss will show a different/additional trust store compared to what OpenSSL uses.

This Red Hat resource may be of relevance https://access.redhat.com/solutions/1549003

In short: update-ca-trust extract

Why does curl work with a specific https site, but wget has problems with certificates?

Related

Recent Posts