Cannot verify wordpress.org's certificate

  • Resolved iframe

    (@iframe)


    11 years, 7 months ago

    Hello.

    I have used wget for many years to download the latest WordPress version but curretly there’s something fishy.

    Please take a look:

    wget http://wordpress.org/latest.tar.gz
--2014-10-04 07:40:34--  http://wordpress.org/latest.tar.gz
Resolving wordpress.org... 66.155.40.249, 66.155.40.250
Connecting to wordpress.org|66.155.40.249|:80... connected.
HTTP request sent, awaiting response... 302 Moved Temporarily
Location: https://wordpress.org/latest.tar.gz [following]
--2014-10-04 07:40:34--  https://wordpress.org/latest.tar.gz
Connecting to wordpress.org|66.155.40.249|:443... connected.
ERROR: cannot verify wordpress.org's certificate, issued by
/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2':
  Unable to locally verify the issuer's authority.
Viewing 7 replies - 1 through 7 (of 7 total)
  • Thread Starter iframe

    (@iframe)

    11 years, 7 months ago

    Looking further, just found that Firefox on wordpress.org ‘Page Info’: ‘Security’ reads:

    This website does not supply ownership information

    What’s going on with wordpress.org?

    Thread Starter iframe

    (@iframe)

    11 years, 7 months ago

    Moderator, is there a way to reach a wordpress.org webmaster to address this issue?

    It’s all about security, right?

    Thank you.

    Moderator Samuel Wood (Otto)

    (@otto42)

    WordPress.org Admin

    11 years, 7 months ago

    There’s nothing wrong with wordpress.org or with our certificate.

    You’re using an old version of wget. Update your copy to a newer version.

    Additionally, wordpress.org is all SSL now. That old “http://wordpress.org” address will no longer work. It redirects to https instead, and thus the certificate gets verified.

    Please read:

    WordPress.org is now forced SSL

    Thread Starter iframe

    (@iframe)

    11 years, 7 months ago

    Thanks, Otto.

    Thread Starter iframe

    (@iframe)

    11 years, 7 months ago

    Marked as resolved.

    Thanks again.

    Ken Dirschl

    (@badfun)

    11 years, 5 months ago

    I have this exact issue using wget for windows. Latest version.

    Capobis

    (@ioweuiraosjfosj)

    11 years ago

    wget behaviour changed, it checks certs now, and it didn’t before.

    From the documentation:

    ‘–no-check-certificate’
    Don’t check the server certificate against the available certificate authorities. Also
    don’t require the URL host name to match the common name presented by the
    certificate.
    As of Wget 1.10, the default is to verify the server’s certificate against the recognized certificate authorities, breaking the SSL handshake and aborting the download
    if the verification fails. Although this provides more secure downloads, it does break
    interoperability with some sites that worked with previous Wget versions, particularly those using self-signed, expired, or otherwise invalid certificates. This option
    forces an “insecure” mode of operation that turns the certificate verification errors
    into warnings and allows you to proceed.
    If you encounter “certificate verification” errors or ones saying that “common name
    doesn’t match requested host name”, you can use this option to bypass the verification and proceed with the download. Only use this option if you are otherwise
    convinced of the site’s authenticity, or if you really don’t care about the validity of
    its certificate. It is almost always a bad idea not to check the certificates when
    transmitting confidential or important data.

Viewing 7 replies - 1 through 7 (of 7 total)

The topic ‘Cannot verify wordpress.org's certificate’ is closed to new replies.