0

I'm using wget to check if several boxes have access to other servers. The problem is sometimes the servers attempt to self-sign and the script hangs when this happens. It simply stops on the line

 To connect to www.google.com insecurely, use '--no-check-certificate'.

I don't necessarily want to do --no-check-certificate as all I need is this line: 

 Connecting to https://www.google.com|xx.xxx.xxx.xxx... connected

and I understand the no check certificate to not necessarily be a secure option.

Is there a way to get wget to stop, timeout, or otherwise cancel if it encounters a server with a self-signed certificate?

EDIT: I forgot to mention I'm on SunOS 10 with WGET 1.12. An example of the wget line I'm using is

variable[i]=$(wget -O- --no-http-keep-alive https://www.google.com | grep connected)
6
  • wget should terminate immediately after it aborts due to an untrusted certificate. I don't know why it isn't in your case. But you also say that all you need to do is connect, you don't need to actually perform an HTTPS request, so why don't you use something like nc which will just connect to the remote host and port and do nothing else?
    – Celada
    Jul 28, 2015 at 18:45
  • Unfortunately the boxes we're testing on don't have nc installed on them, nor do I have the privilege to install it. (I'm a lowly temp!)
    – mkingsbu
    Jul 28, 2015 at 19:15
  • 1
    Is there any reason you can't use --no-check-certificate? The security issue is that, with an unverified certificate, someone might have forged it and so be able to snoop on your data traffic. But since you don't actually seem to be sending anything, there is no sensitive data to protect in the first place.
    – marinus
    Jul 28, 2015 at 20:24
  • 2
    @marinus --no-check-certificate also has the implication that you don't know whether it's the intended server that's responding, or an usurper of its IP address.
    – Gilles 'SO- stop being evil'
    Jul 28, 2015 at 23:29
  • 2
    wget -O- --no-http-keep-alive https://www.google.com | grep connected doesn't make sense, do you want to grep the web page content?
    – yaegashi
    Jul 28, 2015 at 23:52

1 Answer 1

Reset to default
2

What security property do you want?

HTTPS with a verified certificate provides cryptographic assurance that the server is the expected one. If you need this level of assurance, then self-signed certificates won't do unless they're pre-shared. If you have pre-shared certificates, pass them to wget with the --ca-certificate option.

Without HTTPS, a request like wget http://www.example.com is subject to two kinds of attacks:

  • An attack on DNS, causing an incorrect IP address belonging to the attacker to be returned for www.example.com.
  • An attack on IP routing, allowing the attacker to receive and send packets as the IP address of www.example.com.

If you're making these requests on a local network, these threats are often not a concern. If you don't care about these threats, either because you have enough physical security or because it's ok if your monitoring software is fooled, then you don't need HTTPS. If the servers only respond to HTTPS, you can use --no-check-certificate if you don't care about these threats.

If you only want to test that the web server is responding, wget is overkill. You can use curl --head to make a HEAD request rather than a GET, to save some traffic. You can use openssl s_client -connect www.example.com:443 </dev/null to initiate an HTTPS connection and disconnect immediately without sending any data inside the TLS connection.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .