If you don't care about checking the validity of the certificate just add the --no-check-certificate option on the wget command-line. This worked well for me.
NOTE: This opens you up to man-in-the-middle (MitM) attacks, and is not recommended for anything where you care about security.
Looking at current hacky solutions in here, I feel I have to describe a proper solution after all.
First, you need to install the cygwin package ca-certificates via Cygwin's setup.exe to get the certificates.
Do NOT use curl or similar hacks to download certificates (as a neighboring answer advices) because that's fundamentally insecure and may compromise the system.
Second, you need to tell wget where your certificates are, since it doesn't pick them up by default in Cygwin environment. If you can do that either with the command-line parameter --ca-directory=/usr/ssl/certs (best for shell scripts) or by adding ca_directory = /usr/ssl/certs to ~/.wgetrc file.
You can also fix that by running ln -sT /usr/ssl /etc/ssl as pointed out in another answer, but that will work only if you have administrative access to the system. Other solutions I described do not require that.
Cygwin 的 Wget 对 AV 根证书一无所知，因此当它发现网站的证书是用不信任证书签名时，它会打印该错误。
要在不禁用 AV 的情况下永久修复此问题，您应该将 AV 根证书作为 .pem 文件（base64 编码）从 Windows 证书存储复制到 /etc/pki/ca-trust/source/anchors 并运行 更新-ca-trust
I have the similar problem and fixed it by temporarily disabling my antivirus(Kaspersky Free 18.0.0.405). This AV has HTTPS interception module that automatically self-sign all certificates it finds in HTTPS responses.
Wget from Cygwin does not know anything about AV root certificate, so when it finds that website's certificate was signed with non trust certificate it prints that error.
To fix this permanently without disabling AV you should copy the AV root certificate from Windows certificate store to /etc/pki/ca-trust/source/anchors as .pem file(base64 encoding) and run update-ca-trust
$ sudo date +%Y%m%d -s "20210101"
$ sudo ntpdate times1.mike.fi
In my case, on raspberry pi 3B the timing was in the future (2025) that I need to update to the current local time using ntpdate by passing the time to the past and it solved the issue.
$ sudo date +%Y%m%d -s "20210101"
$ sudo ntpdate times1.mike.fi
如果有人因为“证书不受信任”而导致 Cygwin wget 无法工作，并且安装了 ca 证书，并且防病毒软件会自动对它在 HTTPS 响应中找到的所有证书进行自签名，那么您需要：
从您的 AV 获取根证书（我通过浏览器获取了我的根证书） ：打开任意https网站，检查其证书，进入证书路径选项卡，点击根证书，然后点击查看证书按钮，进入。 详细信息 选项卡并单击复制到文件... 按钮。默认设置适合将证书保存在 *.cer 文件中。
将 *.cer 转换为 *.crt。您可以通过以下命令使用 Cygwin 的 OpenSSL：
openssl x509 -inform DER -in <您的 *.cer 证书文件> -out.crt
将新的 *.crt 文件移动到 ca 目录（在我的例子中是 /etc/pki/tls/certs/）。
这足以让我让 wget 工作了。
Thanks to Denis Bakharev I've solved that case.
If someone has Cygwin wget not working because 'certificate not trusted' and having ca-certificates installed AND having Antivirus that automatically self-sign all certificates it finds in HTTPS responses then you need:
Get root certificate from your AV (I got mine with browser: open any https web-site, check it's certificate, go to Certification Path tab, click on Root certificate. Then click View certificate button, go to Details tab and click Copy to File... button. Default settings are fine for saving certificate in *.cer file).
Convert *.cer to *.crt. You can use Cygwin's OpenSSL with the following command:
I had a similar problem with wget to my own live web site returning errors after installing a new SSL certificate. I'd already checked several browsers and they didn't report any errors:
wget --no-cache -O - "https://example.com/..." ERROR: The certificate of ‘example.com’ is not trusted. ERROR: The certificate of ‘example.com’ hasn't got a known issuer.
The problem was I had installed the wrong certificate authority .pem/.crt file from the issuer. Usually they bundle the SSL certificate and CA file as a zip file, but DigiCert email you the certificate and you have to figure out the matching CA on your own. https://www.digicert.com/help/ has an SSL certificate checker which lists the SSL authority and the hopefully matching CA with a nice blue link graphic if they agree:
We just had this same issue come up when we installed a newly minted certificate just this last week. I've also seen it two other times...yet I'm slow to learn. In all 3 cases I had to get the "intermediate certificates" and install them. In other words My cert was good but it's signer or it's signer's signer wasn't correctly installed. Make sure you go to your certificate provider's site and get the correct intermediate certificates and install them as well on your server and then this warning will go away.
It might not JUST be the above, it could also be that clients don't have updated lists...but I would make sure it's not just you not fully installing the certificates right FIRST, and then after that going on to the clients and making sure their list is updated.
In my case, it was happening because I was using an outdated base image. So, I changed it from java:8 to the official openjdk:8 image and I didn't get the error anymore on wget. So, you may need to change your base image or os which isn't outdated and wget should work. I think, the root cause is this: DST Root CA X3 Expiration (September 2021)
If you are using windows just go to control panel, click on automatic updates then click on Windows Update Web Site link. Just follow the step. At least this works for me, no more certificates issue i.e whenever I go to https://www.dropbox.com as before.
发布评论
评论（15）
只要做
Just do
如果您不关心检查证书的有效性，只需在 wget 命令行上添加
--no-check-certificate选项即可。这对我来说效果很好。注意：这会让您面临中间人 (MitM) 攻击，并且不建议您在关心安全的情况下使用。
If you don't care about checking the validity of the certificate just add the
--no-check-certificateoption on the wget command-line. This worked well for me.NOTE: This opens you up to man-in-the-middle (MitM) attacks, and is not recommended for anything where you care about security.
看看这里当前的 hacky 解决方案，我觉得我毕竟必须描述一个正确的解决方案。
首先，您需要通过 Cygwin 的 setup.exe 安装 cygwin 软件包
ca-certificates来获取证书。不要使用curl或类似的黑客来下载证书（作为相邻答案的建议），因为这从根本上来说是不安全的，并且可能会损害系统。
其次，您需要告诉wget您的证书在哪里证书是，因为它在 Cygwin 环境中默认不获取它们。如果您可以使用命令行参数
--ca-directory=/usr/ssl/certs（最适合 shell 脚本）或添加ca_directory = /usr/ssl/ certs到~/.wgetrc文件。您还可以通过运行 ln -sT /usr/ssl /etc/ssl 来解决此问题，如另一个答案中指出的那样，但这仅在您对系统具有管理访问权限时才有效。< /strong> 我描述的其他解决方案不需要这样做。
Looking at current hacky solutions in here, I feel I have to describe a proper solution after all.
First, you need to install the cygwin package
ca-certificatesvia Cygwin's setup.exe to get the certificates.Do NOT use curl or similar hacks to download certificates (as a neighboring answer advices) because that's fundamentally insecure and may compromise the system.
Second, you need to tell wget where your certificates are, since it doesn't pick them up by default in Cygwin environment. If you can do that either with the command-line parameter
--ca-directory=/usr/ssl/certs(best for shell scripts) or by addingca_directory = /usr/ssl/certsto~/.wgetrcfile.You can also fix that by running
ln -sT /usr/ssl /etc/sslas pointed out in another answer, but that will work only if you have administrative access to the system. Other solutions I described do not require that.如果问题是缺少已知的根 CA，并且当您使用 ubuntu 或 debian 时，则可以使用这一行解决问题：
If the problem is that a known root CA is missing and when you are using ubuntu or debian, then you can solve the problem with this one line:
也许这会有所帮助：
May be this will help:
首先，需要安装 SSL 证书。说明（基于https://stackoverflow.com/a/4454754/278488）：
以上内容足以修复< code>curl，但
wget需要额外的符号链接：First, the SSL certificates need to be installed. Instructions (based on https://stackoverflow.com/a/4454754/278488):
The above is enough to fix
curl, butwgetrequires an extra symlink:我有类似的问题并通过暂时禁用我的防病毒软件（卡巴斯基免费版 18.0.0.405）来修复它。该反病毒软件具有 HTTPS 拦截模块，可自动对其在 HTTPS 响应中找到的所有证书进行自签名。
Cygwin 的 Wget 对 AV 根证书一无所知，因此当它发现网站的证书是用不信任证书签名时，它会打印该错误。
要在不禁用 AV 的情况下永久修复此问题，您应该将 AV 根证书作为 .pem 文件（base64 编码）从 Windows 证书存储复制到
/etc/pki/ca-trust/source/anchors并运行更新-ca-trustI have the similar problem and fixed it by temporarily disabling my antivirus(Kaspersky Free 18.0.0.405). This AV has HTTPS interception module that automatically self-sign all certificates it finds in HTTPS responses.
Wget from Cygwin does not know anything about AV root certificate, so when it finds that website's certificate was signed with non trust certificate it prints that error.
To fix this permanently without disabling AV you should copy the AV root certificate from Windows certificate store to
/etc/pki/ca-trust/source/anchorsas .pem file(base64 encoding) and runupdate-ca-trusts有所不同；）The
smakes the difference ;)就我而言，在树莓派 3B 上，时间是在未来（2025 年），我需要使用 ntpdate 将时间传递到过去来更新到当前本地时间，它解决了问题。
In my case, on raspberry pi 3B the timing was in the future (2025) that I need to update to the current local time using
ntpdateby passing the time to the past and it solved the issue.感谢丹尼斯·巴哈列夫（Denis Bakharev），我解决了这个案子。
如果有人因为“证书不受信任”而导致 Cygwin wget 无法工作，并且安装了 ca 证书，并且防病毒软件会自动对它在 HTTPS 响应中找到的所有证书进行自签名，那么您需要：
证书路径选项卡，点击根证书，然后点击查看证书按钮，进入。详细信息选项卡并单击复制到文件...按钮。默认设置适合将证书保存在 *.cer 文件中。openssl x509 -inform DER -in <您的 *.cer 证书文件> -out.crt
/etc/pki/tls/certs/）。这足以让我让 wget 工作了。
Thanks to Denis Bakharev I've solved that case.
If someone has Cygwin wget not working because 'certificate not trusted' and having ca-certificates installed AND having Antivirus that automatically self-sign all certificates it finds in HTTPS responses then you need:
Certification Pathtab, click on Root certificate. Then clickView certificatebutton, go toDetailstab and clickCopy to File...button. Default settings are fine for saving certificate in *.cer file).openssl x509 -inform DER -in <your *.cer certificate file> -out <new cert>.crt/etc/pki/tls/certs/).That was enough for me to get wget working.
在安装新的 SSL 证书后，我也遇到了类似的问题，wget 到我自己的实时网站返回错误。我已经检查了几个浏览器，它们没有报告任何错误：
wget --no-cache -O - "https://example.com/..." 错误：'example.com 的证书' 不被信任。错误：“example.com”的证书没有已知的颁发者。问题是我从颁发者那里安装了错误的证书颁发机构 .pem/.crt 文件。通常他们将 SSL 证书和 CA 文件捆绑为 zip 文件，但 DigiCert 通过电子邮件将证书发送给您，您必须自行找出匹配的 CA。 https://www.digicert.com/help/ 有一个 SSL 证书检查器，其中列出了 SSL权威机构和希望匹配的 CA 具有漂亮的蓝色链接图形（如果他们同意）：
`SSL 证书：颁发者 GeoTrust TLS DV RSA 混合 SHA256 2020 CA-1
CA：主题 GeoTrust TLS DV RSA 混合SHA256 2020 CA-1
有效期为2020年7月16日至2023年5月31日
发行人 DigiCert 全局根 CA`
I had a similar problem with wget to my own live web site returning errors after installing a new SSL certificate. I'd already checked several browsers and they didn't report any errors:
wget --no-cache -O - "https://example.com/..." ERROR: The certificate of ‘example.com’ is not trusted. ERROR: The certificate of ‘example.com’ hasn't got a known issuer.The problem was I had installed the wrong certificate authority .pem/.crt file from the issuer. Usually they bundle the SSL certificate and CA file as a zip file, but DigiCert email you the certificate and you have to figure out the matching CA on your own. https://www.digicert.com/help/ has an SSL certificate checker which lists the SSL authority and the hopefully matching CA with a nice blue link graphic if they agree:
`SSL Cert: Issuer GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1
CA: Subject GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1
Valid from 16/Jul/2020 to 31/May/2023
Issuer DigiCert Global Root CA`
上周，当我们安装新创建的证书时，我们刚刚遇到了同样的问题。我也看过两次……但我学得很慢。在所有 3 种情况下，我都必须获得“中间证书”并安装它们。换句话说，我的证书很好，但它的签名者或其签名者的签名者未正确安装。确保您访问证书提供商的站点并获取正确的中间证书并将它们安装在您的服务器上，然后此警告就会消失。
可能不只是上面的情况，也可能是客户端没有更新列表...但我会确保这不仅仅是您没有先完全安装证书，然后再安装向客户传达并确保他们的列表得到更新。
We just had this same issue come up when we installed a newly minted certificate just this last week. I've also seen it two other times...yet I'm slow to learn. In all 3 cases I had to get the "intermediate certificates" and install them. In other words My cert was good but it's signer or it's signer's signer wasn't correctly installed. Make sure you go to your certificate provider's site and get the correct intermediate certificates and install them as well on your server and then this warning will go away.
It might not JUST be the above, it could also be that clients don't have updated lists...but I would make sure it's not just you not fully installing the certificates right FIRST, and then after that going on to the clients and making sure their list is updated.
不完全是同一个问题。在 docker 上，我将主机文件系统安装到
/etc，其中已经安装了 OpenSSL 证书，但会被覆盖。更改安装到不同的文件系统修复了它。
Not exactly the same issue. On docker, I was mounting my host filesystem to
/etcwhere OpenSSL certs were already installed which gets overwritten.Changing the mounting to different filesystem fixed it.
就我而言，发生这种情况是因为我使用的是过时的基础映像。因此，我将其从
java:8更改为官方openjdk:8映像，并且在wget上不再收到错误。因此，您可能需要更改未过时的基本映像或操作系统，并且 wget 应该可以工作。我认为，根本原因是这样的： DST Root CA X3到期（2021 年 9 月）In my case, it was happening because I was using an outdated base image. So, I changed it from
java:8to the officialopenjdk:8image and I didn't get the error anymore onwget. So, you may need to change your base image or os which isn't outdated and wget should work. I think, the root cause is this: DST Root CA X3 Expiration (September 2021)如果您使用的是 Windows，只需转到控制面板，单击“自动更新”，然后单击“Windows 更新网站”链接。只需按照步骤操作即可。至少这对我有用，不再有证书问题，即每当我访问 https://www.dropbox.com 时和以前一样。
If you are using windows just go to control panel, click on automatic updates then click on Windows Update Web Site link. Just follow the step. At least this works for me, no more certificates issue i.e whenever I go to https://www.dropbox.com as before.