[kwlug-disc] wget and --no-check-certificates with Unlimitel

[Bob Jonkman]

If the certificate is issued to primus.ca, but the URL you're accessing 
is unlimitel.ca then you'll get errors.  But I don't know if that's the 
meaning of "Unable to locally verify the issuer's authority".

Unlimitel was recently bought by Primus, so up to now they may have been 
using certificates issued to unlimitel.ca, which matches the URL.

--Bob.

On 11-06-04 10:05 PM, Paul Nijjar wrote:
> I am using Unlimitel's API to get information about our accounts. The
> API is documented here:
>
> http://www.unlimitel.ca/temp/support/voip_support/api-documentation-v2.pdf
>
> Here is the line in question, with our customer number suitably
> masked:
>
> wget https://api.unlimitel.ca/getlastmonthcdr.php?custnum=XXXXX
>
> This used to work fine last month. This month wget gives me the
> following errors:
>
> Resolving api.unlimitel.ca... 216.254.136.108
> Connecting to api.unlimitel.ca|216.254.136.108|:443... connected.
> ERROR: cannot verify api.unlimitel.ca's certificate, issued by
> `/C=US/O=GeoTrust, Inc./CN=GeoTrust SSL CA':
>    Unable to locally verify the issuer's authority.
> To connect to api.unlimitel.ca insecurely, use
> `--no-check-certificate'.
> Unable to establish SSL connection.
>
> The "--no-check-certificate" option works, but it is scary.
>
> I don't know what wget is trying to do that fails.
>
> I am not sure what has changed on Unlimitel's side. It looks like the
> certificates belong to Primus, and have a "notbefore" field of
> "4/3/2011" -- so April 3 2011?  (Good grief. ISO 8601 is a good idea,
> people.) I guess this means something changed with the cert since the
> last time this script ran?
>
> I would appreciate any of the following:
> - Confirmation that something is wrong
> - An explanation of what is wrong and the best way to fix it
> - Whether I should just give in and se the --no-check-certificate
>    option.
>
>
>
> - Paul
>
>