{"id":235,"date":"2008-08-27T16:26:22","date_gmt":"2008-08-27T20:26:22","guid":{"rendered":"http:\/\/benjamin.smedbergs.us\/blog\/?p=235"},"modified":"2008-08-27T16:26:45","modified_gmt":"2008-08-27T20:26:45","slug":"how-to-teach-wget-about-security","status":"publish","type":"post","link":"http:\/\/benjamin.smedbergs.us\/blog\/2008-08-27\/how-to-teach-wget-about-security\/","title":{"rendered":"Teaching wget About Root Certificates"},"content":{"rendered":"<p>I am setting up some temporary tinderboxes to repack localization builds. Because I don&#8217;t trust the DNS service from my home ISP, I wanted to download builds from ftp.mozilla.org using HTTPS. It turns out this was quite the challenging task, due to the following cute and relatively useless error message:<\/p>\n<blockquote><p><tt>ERROR: Certificate verification error for ftp.mozilla.org: unable to get local issuer certificate<br \/>\nTo connect to ftp.mozilla.org insecurely, use '--no-check-certificate'.<\/tt><\/p><\/blockquote>\n<p>What this really means is &#8220;your copy of wget\/OpenSSL didn&#8217;t come with any root certificates, and HTTPS just isn&#8217;t going to work until you get them and I know about them.&#8221;<\/p>\n<h3>Getting Root Certificates<\/h3>\n<p>The best way to get the root certificates you need is at <a href=\"http:\/\/curl.haxx.se\/docs\/caextract.html\">this website<\/a>. It has a tool that will convert the root certificates built-in to Mozilla NSS into the PEM format that OpenSSL expects. It also has pre-converted PEM files available for download if you&#8217;re lazy.<\/p>\n<h3>Installing cacert.pem into MozillaBuild (Windows)<\/h3>\n<p>To install cacert.pem so that it works with MozillaBuild:<\/p>\n<ol>\n<li>Copy cacert.pem to <tt>c:\/mozilla-build\/wget\/cacert.pem<\/tt>\n<li>Create the following configuration file at <tt>c:\/mozilla-build\/wget\/wget.ini<\/tt>:\n<pre>ca_certificate=c:\/mozilla-build\/wget\/cacert.pem<\/pre>\n<\/ol>\n<p>Ted <a href=\"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=452480\">filed a bug<\/a> about setting this up automatically for a future version of MozillaBuild.<\/p>\n<h3>Installing cacert.pem on Mac:<\/h3>\n<p>The following instructions assume you got your wget from macports using <tt>port install wget<\/tt>.<\/p>\n<ol>\n<li>Copy cacert.pem to <tt>\/opt\/local\/etc\/cacert.pem<\/tt>\n<li>Create the following configuration file at <tt>\/opt\/local\/etc\/wgetrc<\/tt>:\n<pre>ca_certificate=\/opt\/local\/etc\/cacert.pem<\/pre>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>I am setting up some temporary tinderboxes to repack localization builds. Because I don&#8217;t trust the DNS service from my home ISP, I wanted to download builds from ftp.mozilla.org using HTTPS. It turns out this was quite the challenging task, due to the following cute and relatively useless error message: ERROR: Certificate verification error for [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[138,140,141,139,137],"class_list":["post-235","post","type-post","status-publish","format-standard","hentry","category-mozilla","tag-certificate","tag-https","tag-mozillabuild","tag-openssl","tag-wget"],"_links":{"self":[{"href":"http:\/\/benjamin.smedbergs.us\/blog\/wp-json\/wp\/v2\/posts\/235","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/benjamin.smedbergs.us\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/benjamin.smedbergs.us\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/benjamin.smedbergs.us\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/benjamin.smedbergs.us\/blog\/wp-json\/wp\/v2\/comments?post=235"}],"version-history":[{"count":0,"href":"http:\/\/benjamin.smedbergs.us\/blog\/wp-json\/wp\/v2\/posts\/235\/revisions"}],"wp:attachment":[{"href":"http:\/\/benjamin.smedbergs.us\/blog\/wp-json\/wp\/v2\/media?parent=235"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/benjamin.smedbergs.us\/blog\/wp-json\/wp\/v2\/categories?post=235"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/benjamin.smedbergs.us\/blog\/wp-json\/wp\/v2\/tags?post=235"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}