I have the same issue.
Some investigations:
1. I decided to find out the particular command that fails and added
more debug print:
diff --git a/bootstrap b/bootstrap
index 7523f65b4..44c21db23 100755
--- a/bootstrap
+++ b/bootstrap
@@ -749,6 +749,7 @@ download_po_files() {
domain=$2
echo "$me: getting translations into $subdir for $domain..."
cmd=$(printf "$po_download_command_format" "$subdir" "$domain")
+ echo "$me: going to exec \"$cmd\"..."
eval "$cmd"
}
2. Tried to run:
$ ./bootstrap
./bootstrap: Bootstrapping from checked-out coreutils sources...
./bootstrap: consider installing git-merge-changelog from gnulib
./bootstrap: getting gnulib files...
./bootstrap: getting translations into po/.reference for coreutils...
./bootstrap: going to exec "wget --mirror --level=1 -nd -nv -A.po -P
'po/.reference' https://translationproject.org/latest/coreutils/";...
ERROR: The certificate of 'translationproject.org' is not trusted.
ERROR: The certificate of 'translationproject.org' doesn't have a known
issuer.
3. Tried to run the command directly, but without `-nv` flag:
$ wget --mirror --level=1 -nd -v -A.po -P 'po/.reference'
https://translationproject.org/latest/coreutils/
--2021-02-13 14:23:35-- https://translationproject.org/latest/coreutils/
Loaded CA certificate '/etc/ssl/certs/ca-certificates.crt'
Resolving translationproject.org (translationproject.org)...
80.69.83.146, 2a01:7c8:c037:6::20
Connecting to translationproject.org
(translationproject.org)|80.69.83.146|:443...
connected.
ERROR: The certificate of ‘translationproject.org’ is not trusted.
ERROR: The certificate of ‘translationproject.org’ doesn't have a known
issuer.
4. Tried the same with curl:
$ curl -v https://translationproject.org/latest/coreutils/ -o /dev/null
% Total % Received % Xferd Average Speed Time Time Time
Current
Dload Upload Total Spent Left
Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:--
0* Trying 80.69.83.146:443...
* Connected to translationproject.org (80.69.83.146) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: none
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [93 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [6723 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [589 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [70 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server did not agree to a protocol
* Server certificate:
* subject: CN=stats.vrijschrift.org
* start date: Dec 31 10:34:41 2020 GMT
* expire date: Mar 31 10:34:41 2021 GMT
* subjectAltName: host "translationproject.org" matched cert's
"translationproject.org"
* issuer: C=US; O=Let's Encrypt; CN=R3
* SSL certificate verify ok.
} [5 bytes data]
> GET /latest/coreutils/ HTTP/1.1
> Host: translationproject.org
> User-Agent: curl/7.75.0
> Accept: */*
>
{ [5 bytes data]
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Date: Sat, 13 Feb 2021 12:26:00 GMT
< Server: Apache/2.4.10 (Debian)
< Vary: Accept-Encoding
< Transfer-Encoding: chunked
< Content-Type: text/html;charset=UTF-8
<
{ [5 bytes data]
100 8881 0 8881 0 0 16980 0 --:--:-- --:--:-- --:--:--
16980
* Connection #0 to host translationproject.org left intact
5. Trying to export and verify the cert with certtools:
$ certtool --verbose --verify-profile=high --verify --infile=/tmp/
stats.vrijschrift.org
Loaded system trust (139 CAs available)
Subject: CN=R3,O=Let's Encrypt,C=US
Issuer: CN=DST Root CA X3,O=Digital Signature Trust Co.
Signature algorithm: RSA-SHA256
Output: Not verified. The certificate is NOT trusted. The
certificate issuer is unknown.
Subject: CN=R3,O=Let's Encrypt,C=US
Issuer: CN=DST Root CA X3,O=Digital Signature Trust Co.
Signature algorithm: RSA-SHA256
Output: Not verified. The certificate is NOT trusted. The
certificate issuer is unknown.
Subject: CN=R3,O=Let's Encrypt,C=US
Issuer: CN=DST Root CA X3,O=Digital Signature Trust Co.
Checked against: CN=DST Root CA X3,O=Digital Signature Trust Co.
Signature algorithm: RSA-SHA256
Output: Verified. The certificate is trusted.
Subject: CN=stats.vrijschrift.org
Issuer: CN=R3,O=Let's Encrypt,C=US
Checked against: CN=R3,O=Let's Encrypt,C=US
Signature algorithm: RSA-SHA256
Output: Verified. The certificate is trusted.
Chain verification output: Verified. The certificate is trusted.
Maybe that "Output: Not verified. The certificate is NOT trusted. The
certificate issuer is unknown." Is the issue?
Thanks!
Best regards,
Grigorii
