We have a script that downloads mod security from github that has recently started failing. The servers run CentOS 6 but RHEL 6 probably has the same issue. The output is:

# wget https://github.com/downloads/SpiderLabs/ModSecurity/modsecurity-apache_2.7.1.tar.gz
--2014-07-22 18:49:46--  https://github.com/downloads/SpiderLabs/ModSecurity/modsecurity-apache_2.7.1.tar.gz
Resolving github.com...
Connecting to github.com||:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://cloud.github.com/downloads/SpiderLabs/ModSecurity/modsecurity-apache_2.7.1.tar.gz [following]
--2014-07-22 18:49:47--  https://cloud.github.com/downloads/SpiderLabs/ModSecurity/modsecurity-apache_2.7.1.tar.gz
Resolving cloud.github.com...,,, ...
Connecting to cloud.github.com||:443... connected.
OpenSSL: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
Unable to establish SSL connection.

Any ideas on how to fix or work around this?

  • 2
    use another application, e.g curl – Rabin Jul 22 '14 at 20:50
  • 1
    To be more specific, both and several of the (different) A's I get for cloud.github.com give handshake failure to s_client without option for ServerNameIndication. serverfault.com/questions/560053/… says (several months ago) RedHat wget doesn't do SNI but curl does. – dave_thompson_085 Jul 23 '14 at 0:32
  • You feel lucky to accept my answer – Anton Dozortsev Jul 23 '14 at 16:25
  • Well, to be honest I would prefer if @dave_thompson_085 or Rabin posted their comments as answers as I see that as more of a long term solution even though your workaround also works great! – Kristofer Jul 24 '14 at 8:32

If I'm not mistaken you mean this repo. Try to get URL form Releases.

This case work for me:

$ wget https://github.com/SpiderLabs/ModSecurity/archive/v2.8.0.tar.gz

P.S. I also have the same error message when try to run your case;

$ wget https://github.com/downloads/SpiderLabs/ModSecurity/modsecurity-apache_2.7.1.tar.gz

You can use the curl command to download it:

curl -LO https://github.com/downloads/SpiderLabs/ModSecurity/modsecurity-apache_2.7.1.tar.gz
  • 5
    curl -L -O is a better replacement for wget, since it follows HTTP redirects (particularly useful here since Github wants to point me to its CDN). – strangefeatures Nov 18 '14 at 4:43
  • Also, one thing I ran into with the versions in CentOS 6.5 is that curl supports SNI and wget does not, so for some sites wget will sometimes be served the certificate for the wrong host and get a certificate failure, even if curl works fine. – rakslice Dec 16 '14 at 2:41

Server side has disabled the SSLv3 encryption handshake, because of SSLv3 severe security issues. Moreover, your wget client is an outdated version and still use as default this SSLv3 encryption. You have 2 options:

  • use --secure-protocol=TLSv1 flag in front of wget. wget --secure-protocol=TLSv1
  • install an updated version of wget that use as default TLSv1 protocol

You should check your wget version.

I had the same problem with older versions of wget (< 1.15).

  • 2
    This looks like this should be a comment against the question, and not an answer. – Danny Staple Jan 16 '15 at 13:54

As for workaround, if you trust the host try specifying --no-check-certificate or add:

check_certificate = off

into your ~/.wgetrc (not recommended).

In some rare cases, it's caused by your system time which could be out-of-sync therefore invalidating the certificates which was working before.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.