Unable to establish SSL connection upon wget on Ubuntu 14.04 LTS

Question

I tried to download an image through wget but I got an error: Unable to establish SSL connection.

wget https://www.website.com/image.jpg
--2015-02-26 01:30:17--  https://www.website.com/image.jpg
Resolving www.website.com (www.website.com)... xx.xxx.xx.xx
Connecting to www.website.com (www.website.com)|xx.xxx.xx.xx|:443... connected.
Unable to establish SSL connection.

My test case:

1. Using Ubuntu 12.04.4 LTS (GNU/Linux 3.8.0-44-generic x86_64), GNU Wget 1.13.4 built on linux-gnu, I was able to download the image using the code above. No error.
2. Using Ubuntu 14.04 LTS (GNU/Linux 3.13.0-24-generic x86_64), GNU Wget 1.15 built on linux-gnu, I was not able to download the image using the code above.

Another variable is that the www.website.com uses TLS 1.0. I don't have an idea how this affects wget. But if I wget an image from TLS 1.2 websites I don't get any ssl connection errors from both test cases.

Is Ubuntu 14.04 or wget 1.15 not compatible with TLS 1.0 websites? Do I need to install/download any library/software to enable this connection?

Cockatiel

This sounds like the wget is failing during the SSL handshake. This is most likely occurring because your Ubuntu 14.04 does not trust the domain www.website.com. You may need to install this website's server certificate into your trust store. – Fibrillation

If this error happens with any other SSL site too add this information to your question. If this happens only with a specific site and if this site works in the browser show the exact URL. If this site does not work in the browser too it is a problem if the site itself. – Newby

@TimBiegeleisen I downloaded www.website.com's certificate through Chrome: clicked lock sign -> connection tab -> certificate information link -> details -> URI link. Then I copied it to the server, then followed how to install root certificate (askubuntu.com/questions/73287/…). Then after /etc/ssl/certs$ ls, I found the certificate there. I tried to wget again but I still get the same error. – Cockatiel

@SteffenUllrich right now it happens only to the website I'm testing. I can't post it here because it's confidential. – Cockatiel

Possible duplicate of Unable to establish SSL connection, how do I fix my SSL cert? – Graver

You can also get this error if you're behind some sort of proxy and don't set the HTTP_PROXY and HTTPS_PROXY environment variables – Singlehandedly

Answer 1

... right now it happens only to the website I'm testing. I can't post it here because it's confidential.

Then I guess it is one of the sites which is incompatible with TLS1.2. The openssl as used in 12.04 does not use TLS1.2 on the client side while with 14.04 it uses TLS1.2 which might explain the difference. To work around try to explicitly use --secure-protocol=TLSv1. If this does not help check if you can access the site with openssl s_client -connect ... (probably not) and with openssl s_client -tls1 -no_tls1_1, -no_tls1_2 ....

Please note that it might be other causes, but this one is the most probable and without getting access to the site everything is just speculation anyway.

The assumed problem in detail: Usually clients use the most compatible handshake to access a server. This is the SSLv23 handshake which is compatible to older SSL versions but announces the best TLS version the client supports, so that the server can pick the best version. In this case wget would announce TLS1.2. But there are some broken servers which never assumed that one day there would be something like TLS1.2 and which refuse the handshake if the client announces support for this hot new version (from 2008!) instead of just responding with the best version the server supports. To access these broken servers the client has to lie and claim that it only supports TLS1.0 as the best version.

Is Ubuntu 14.04 or wget 1.15 not compatible with TLS 1.0 websites? Do I need to install/download any library/software to enable this connection?

The problem is the server, not the client. Most browsers work around these broken servers by retrying with a lower version. Most other applications fail permanently if the first connection attempt fails, i.e. they don't downgrade by itself and one has to enforce another version by some application specific settings.

Newby

One such confidential site is playboyplus.com - with or without "--secure-protocol=TLSv1", it sometimes works and sometimes it doesn't work. For me it worked 4 times from 10 tries – Ever

It's the same when using curl - "curl -kLo a.htm playboyplus.com" - sometimes it works, sometimes you get "OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to www.playboyplus.com:443" – Ever

@JoeJobs: If you want to get help with a problem please ask a new question and don't ask in the comments, especially not for Q+A from many years ago. It is likely a different cause of the problem than discussed here anyways, since TLS stacks on both client and server evolved in the recent years. – Newby

Answer 2

you must be using old version of wget i had same issue. i was using wget 1.12.so to solve this issue there are 2 way: Update wget or use curl

curl -LO 'https://example.com/filename.tar.gz'

Zepeda

Answer 3

Although this is almost certainly not the OPs issue, you can also get Unable to establish SSL connection from wget if you're behind a proxy and don't have HTTP_PROXY and HTTPS_PROXY environment variables set correctly. Make sure to set HTTP_PROXY and HTTPS_PROXY to point to your proxy.

This is a common situation if you work for a large corporation.

Singlehandedly

I would like to ask you If you can elaborate on how to set these environment variables or give some information about their location. I have the same issue on a remote server (I can configure it) but not on my laptop. Thanks in advance – Knorring

@Knorring how to set them will depend on your shell. In bash, it's export <var>=<value>. In powershell it's $Env:<var> = <value>. The proxy variable names also depend on the application, but HTTP_PROXY and HTTPS_PROXY are supported by the vast majority of linux apps (including wget). Details: unix.stackexchange.com/questions/212894/… – Singlehandedly

Answer 4

If you trust the host, either add the valid certificate, specify --no-check-certificate or add:

check_certificate = off

into your ~/.wgetrc.

In some rare cases, your system time could be out-of-sync therefore invalidating the certificates.

Graver

Answer 5

This is how I resolved the issue. I used the "m3w" download command. Basic usage of the "m3w" command: m3w www.exemple.com

Note: once you download to file, you will need ESC/s to save the file.

Misestimate

Answer does not directly address the question, is more of a workaround using other tool. – Achieve

Answer 6

I tried every way written in this and similar pages but it didn't work for me. It worked fine when I changed https => http in the URL.

You can try this as a last ditch.

Zamarripa

Answer 7

I had the same issue and prefix sudo helped me so I just hadn't such rights with common user.

Decorticate

Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center. – Rapture