I have this error:
--2020-06-03 20:55:06-- https://docs.conda.io/projects/conda/en/4.6.0/_downloads/52a95608c49671267e40c689e0bc00ca/conda-cheatsheet.pdf Resolving docs.conda.io (docs.conda.io)... 184.108.40.206, 220.127.116.11, 18.104.22.168, ... Connecting to docs.conda.io (docs.conda.io)|22.214.171.124|:443... connected. ERROR: cannot verify docs.conda.io's certificate, issued by ‘CN=SSL-SG1-GFRPA2,OU=Operations,O=Cloud Services,C=US’: Unable to locally verify the issuer's authority. To connect to docs.conda.io insecurely, use `--no-check-certificate'.
What I have tried to solve this problem:
sudo update-ca-certificates -f
Export the certificate from browser when opening the url, save it in a file
conda.cer, then perform
openssl x509 -in conda.cer -inform der -outform pem -out conda.pem, then execute:
wget --ca-certificate=conda.pem \ https://docs.conda.io/projects/conda/en/4.6.0/_downloads/52a95608c49671267e40c689e0bc00ca/conda-cheatsheet.pdf
=> still the same error
Put the file under
sudo cp conda.pem /etc/ssl/certs=> still same error
I know I can use
--no-check-certificate, but this is not what i want.
This problem occurs for some other websites too. Anyone know the reason? Thanks.
I have tried the following steps:
sudo cp conda.crt /usr/share/ca-certificates/mozilla/
sudo vi /etc/ca-certificates.conf and append
mozilla/conda.crt at the end
sudo update-ca-certificates -f
4) i can see symbolic link created under /etc/ssl/certs which looks like:
conda.pem -> /usr/share/ca-certificates/mozilla/conda.crt
However, it's still not working!
UPDATE2 - Deleted. Please refer to UPDATE3
The certificates chain in the URL above contains 4 certificates.
Just to ensure not missing any one, I put all the 4 certificates (namely
/usr/share/ca-certificates/mozilla/ and repeat the steps mentioned in UPDATE1.
Symbolic links are created successfully in
openssl verify -no-CAfile -no-CApath -partial_chain -CAfile conda1.pem conda2.pem conda2.pem: OK openssl verify -no-CAfile -no-CApath -partial_chain -CAfile conda2.pem conda3.pem conda3.pem: OK openssl verify -no-CAfile -no-CApath -partial_chain -CAfile conda3.pem conda4.pem conda4.pem: OK
Result: still fail with wget
Part of the cause is found
Bluecoat service which intercepts the network is the root cause (it has problem to VM Ubuntu only though, the host machine windows works fine with ssl).
Both of these works (
conda1.crt is extracted from browser which should be from the Bluecoat service):
wget --ca-certificates=/etc/ssl/certs/ca-certificates.crt https://docs.conda.io/projects/conda/en/4.6.0/_downloads/52a95608c49671267e40c689e0bc00ca/conda-cheatsheet.pdf wget --ca-certificates=conda1.crt https://docs.conda.io/projects/conda/en/4.6.0/_downloads/52a95608c49671267e40c689e0bc00ca/conda-cheatsheet.pdf
I have installed
/etc/ssl/certs following the steps described in UPDATE1.
conda1.crt is believed to be the right one as shown in the
wget step in UPDATE4.
However, even after this step, connection still failed.
If I disable Bluecoat service forecely, ssl problem disappeared.
However, I am required to use Bluecoat, hence any help to resolve the problem under Bluecoat is really appreciated!