[SOLVED] updating to latest root-CA certificates in slackware 13.37

srgrn · 07-17-2011, 02:59 AM

Hi,
after installing Slackware 13.37 i've noticed that while when in the Xwindows enviroment inside the mozilla firefox i can surf freely i cannot use wget with the same freedom.
i get the following error with wget

Code:

wget https://dropbox.com
--2011-07-17 10:54:58--  https://dropbox.com/
Resolving dropbox.com (dropbox.com)... 199.47.216.179, 199.47.217.179
Connecting to dropbox.com (dropbox.com)|199.47.216.179|:443... connected.
ERROR: cannot verify dropbox.com's certificate, issued by "/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287":
  Unable to locally verify the issuer's authority.
To connect to dropbox.com insecurely, use '--no-check-certificate'.

how do i update the machine to use the latest root ca's i have downloaded and manually installed ca-certificates_20110502.tar.gz but it still refuse to work with wget.

how can i install the root ca so it will accept ssl when using wget?

Thanks
Eran

sahko · 07-17-2011, 06:06 AM

wrong post

srgrn · 07-17-2011, 10:58 AM

updating to the latest openssl (1.0d) didn't help
i have searched some more and it simply said that his message
"Unable to locally verify the issuer's authority."

is caused by missing intermidiate certificates
but is there a way to force getting those intemediate certificates?

willysr · 07-17-2011, 06:59 PM

try adding "--no-check-certificate" as the wget parameter

srgrn · 07-17-2011, 11:28 PM

i eventually found my problem, for some reason when i did it before updating the certificates and upgrading the openssl to openssl1.0d it haven't worked
i followed the instructions in http://gagravarr.org/writing/openssl...tml#ca-openssl and ran the following commands

Code:

cd /etc/ssl/certs
foreach a (`ls *.pem`)
echo $a
ln -s $a `openssl x509 -hash -noout -in $a`.0 
end

this solved the problem and now i can access https sites like dropbox from cli.
thanks

sahko · 07-18-2011, 06:30 AM

Thanks for posting the solution.

andrew.46 · 07-18-2011, 07:49 PM

Hmmmm.... would the perl script /usr/bin/c_rehash have been of use here?