If I go to this URL https://solarpaces2014.pse.de/typo3/fileadmin/template/images/banner.jpg go looking for the ssl certificates, then I see a valid (wildcard) certificate for our domain pse.de
.
If I go tho this URL https://85.214.107.230/img/common/globe.png
(same IP) then the browser complains that a) the certificate is expired and b) that it is self signed. Thats ok, that's the certificate for the plesk admin site and nobody but our admin uses this site anyway.
If I fecth these file with curl
this happens:
$ curl https://solarpaces2014.pse.de/typo3/fileadmin/template/images/banner.jpg > /dev/null
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 90217 100 90217 0 0 16960 0 0:00:05 0:00:05 --:--:-- 319k
$ curl https://85.214.107.230/img/common/globe.png > /dev/null
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
More details here: http://curl.haxx.se/docs/sslcerts.html
....
curl
is happy with the first certificate and complains about the second one, as expected.
However, when I do the same with wget
:
$ wget https://solarpaces2014.pse.de/typo3/fileadmin/template/images/banner.jpg -O /dev/null
--2014-08-13 15:20:44-- https://solarpaces2014.pse.de/typo3/fileadmin/template/images/banner.jpg
Resolving solarpaces2014.pse.de... 85.214.107.230
Connecting to solarpaces2014.pse.de|85.214.107.230|:443... connected.
ERROR: cannot verify solarpaces2014.pse.de’s certificate, issued by “/C=US/ST=Virginia/L=Herndon/O=Parallels/OU=Parallels Panel/CN=Parallels Panel/emailAddress=info@parallels.com”:
Self-signed certificate encountered.
ERROR: certificate common name “Parallels Panel” doesn’t match requested host name “solarpaces2014.pse.de”.
To connect to solarpaces2014.pse.de insecurely, use ‘--no-check-certificate’.
Why on earth is wget
fetching the wrong certificate? Is this an wget
issue or is there a problem with our apache configuration?