Bug#750601: "GnuTLS: Error in the push function" when using a client certificate

Florent Rougon

unread,

Jun 4, 2014, 6:30:01 PM6/4/14

to

Package: wget
Version: 1.13.4-3+deb7u1
Severity: normal

Hello,

It seems unfortunately that bug #646983 is back in wheezy, or something that
looks similar:

% wget --certificate=*****.pem --private-key=*** -rc -nH -np -vvv \
--ca-cert=*** https://<server-name>:<port>/<path>
--2014-06-03 23:09:39-- https://<server-name>:<port>/<path>
Resolving <server-name> (<server-name>)... <server-ip>
Connecting to <server-name> (<server-name>)|<server-ip>|:<port>... connected.
GnuTLS: Error in the push function.
Unable to establish SSL connection.

The same thing works fine in Firefox as well as with curl (using options
--cert and --key).

Thanks

-- System Information:
Debian Release: 7.5
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.13-0.bpo.1-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages wget depends on:
ii dpkg 1.16.14
ii install-info 4.13a.dfsg.1-10
ii libc6 2.13-38+deb7u1
ii libgcrypt11 1.5.0-5+deb7u1
ii libgnutls26 2.12.20-8+deb7u2
ii libgpg-error0 1.10-3.1
ii libidn11 1.25-2
ii zlib1g 1:1.2.7.dfsg-13

wget recommends no packages.

wget suggests no packages.

-- no debconf information

--
To UNSUBSCRIBE, email to debian-bugs-...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listm...@lists.debian.org

Noël Köthe

unread,

Aug 4, 2015, 8:50:03 AM8/4/15

to

tags 750601 + moreinfo
thanks

Hello Florent,

Am Donnerstag, den 05.06.2014, 00:15 +0200 schrieb Florent Rougon:

> It seems unfortunately that bug #646983 is back in wheezy, or
> something that
> looks similar:
>
> % wget --certificate=*****.pem --private-key=*** -rc -nH -np -vvv \
> --ca-cert=*** https://<server-name>:<port>/<path>;
> --2014-06-03 23:09:39-- https://<server-name>:<port>/<path>;
> Resolving <server-name> (<server-name>)... <server-ip>
> Connecting to <server-name> (<server-name>)|<server-ip>|:<port>...
> connected.
> GnuTLS: Error in the push function.
> Unable to establish SSL connection.
>
> The same thing works fine in Firefox as well as with curl (using
> options
> --cert and --key).

Is this still reproduce able with wget in jessie (1.16) or later?

Thanks.

Regards

Noël

signature.asc

Florent Rougon

unread,

Aug 11, 2015, 4:00:04 PM8/11/15

to

Hello Noël,

Noël Köthe <no...@debian.org> wrote:

> Is this still reproduce able with wget in jessie (1.16) or later?

Um, that was more than one year ago... and I don't have the Apache setup
to test this anymore, unfortunately. I'll keep you informed when I can
do this test again (on jessie and unstable, presumably).

Regards

--
Florent

Florent Rougon

unread,

Aug 28, 2015, 1:00:04 PM8/28/15

to

reopen 750601
retitle 750601 wget: Unable to connect with HTTPS using a client certificate
found 750601 1.16-1
tags 750601 - moreinfo
thanks

Hello,

I'm afraid the problem remains that wget cannot download anything with
HTTPS when a client certificate is required. Tested on current unstable
and jessie (I double checked that connecting to the same address with
the same client cert does work with Firefox).

I retitled the bug since the error message has changed... The exact same
command as before does fail (i.e., from the initial bug report). I
simplified it here a little bit by omitting '-rc', which is not
necessary to reproduce the bug.

On unstable:

% wget --certificate=**** --private-key=**** -nH -np -vvv \
--ca-cert=**** https://<server-name>:<port>/<path>
--2015-08-28 17:58:48-- https://<server-name>:<port>/<path>
Loaded CA certificate '****'

Resolving <server-name> (<server-name>)... <server-ip>
Connecting to <server-name> (<server-name>)|<server-ip>|:<port>... connected.

GnuTLS: A TLS fatal alert has been received.
GnuTLS: received alert [40]: Handshake failed

Unable to establish SSL connection.

%

On jessie, omitting the '--ca-cert=****' option, which is probably not
necessary since the corresponding cert is system-installed on the client
box (in /etc/ssl/certs):

% wget --certificate=**** --private-key=**** -nH -np -vvv \

https://<server-name>:<port>/<path>

--2015-08-28 18:08:22-- https://<server-name>:<port>/<path>

Resolving <server-name> (<server-name>)... <server-ip>
Connecting to <server-name> (<server-name>)|<server-ip>|:<port>... connected.

GnuTLS: A TLS fatal alert has been received.
GnuTLS: received alert [40]: Handshake failed

Unable to establish SSL connection.

%

> I'm marking this as fixed for 1.16 because there were no other bug
> reports like this.

Do you know any user who could successfully use client certs with wget?

I am including below the usual reportbug package/etc. info for the
unstable box used to run the first test from this mail.

Regards

--
Florent

-- System Information:
Debian Release: stretch/sid
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.1.0-2-amd64 (SMP w/8 CPU cores)

Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Init: sysvinit (via /sbin/init)

Versions of packages wget depends on:

ii libc6 2.19-19
ii libgnutls-deb0-28 3.3.17-1
ii libidn11 1.32-1
ii libnettle6 3.1.1-4
ii libpcre3 2:8.35-7.1
ii libpsl0 0.8.0-1
ii libuuid1 2.26.2-9
ii zlib1g 1:1.2.8.dfsg-2+b1

Versions of packages wget recommends:
ii ca-certificates 20150426