Wget fails with certificate error

Question

As part of an automated build, we run download some code from github. Minimal example:

wget github.com

Recently, the command started failing with a certificate error:

URL transformed to HTTPS due to an HSTS policy
--2017-10-05 11:43:45--  https://github.com/
Resolving github.com (github.com)... 192.30.253.112, 192.30.253.113
Connecting to github.com (github.com)|192.30.253.112|:443... connected.

ERROR: cannot verify github.com's certificate, issued by 'CN=DigiCert SHA2 Extended Validation Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US':
  Unable to locally verify the issuer's authority.

I tried updating the certificate store, and wget itself:

update-ca-certificates
apt-get install wget

The error is still the same. My wget version is GNU Wget 1.17.1, and the OS is Ubuntu 16.04.3.

Answer 1

We had similar error on one of our websites that previously had HSTS policy enabled. The error persisted even after we disabled HSTS.

After some digging I found wget keeps HSTS info about a site in local cache file. Deleting the file resolves the problem.

rm ~/.wget-hsts