/errors/wget/unable-to-establish-ssl-connection
wget: Unable to establish SSL connection.
- tool
- wget
- exit code
- 4
- versions
- GNU Wget 1.x
- os
- linux, macos, windows
Unable to establish SSL connection. means wget connected to the server but the TLS handshake failed, so no HTTPS request was sent. wget exits with status 4 (network failure). The useful detail is the line printed just before it: a TLS library error, an OpenSSL: error:... line ending in a reason such as unsupported protocol, or a line such as GnuTLS: The TLS connection was non-properly terminated. (the exact text depends on whether wget was built with OpenSSL or GnuTLS and on the library version). That line tells you whether it is a protocol version, a proxy or a port problem.
This is different from ERROR: cannot verify ... certificate: there the handshake worked but the certificate was not trusted, and wget exits with status 5.
Where the message comes from
In wget's src/http.c, a failed ssl_connect_wget() returns CONSSLERR, which is printed as Unable to establish SSL connection. and mapped to exit status 4 in src/exits.c. A failed proxy tunnel returns the same code after printing Proxy tunneling failed: REASON.
Find the cause
wget -d https://legacy.example.com/file.tar.gz 2>&1 | tail -20
openssl s_client -connect legacy.example.com:443 -servername legacy.example.com </dev/null
openssl s_client -connect legacy.example.com:443 -servername legacy.example.com -tls1_2 </dev/null-d prints wget's debug log, including the TLS library error. openssl s_client shows whether a handshake works at all and with which protocol.
| What you see before the message | Likely cause |
|---|---|
| unsupported protocol, protocol version, no protocols available | server only offers TLS versions your wget refuses |
| wrong version number, packet length too long | https:// sent to a port that answers in plain HTTP |
| Proxy tunneling failed: Forbidden (or another reason) | the proxy refused the CONNECT request |
| connection reset, non-properly terminated | a middlebox or the server closed the connection during the handshake |
Fixes
- Wrong port or scheme: use
http://for a plain HTTP port, or the port that serves TLS (usually 443). - Proxy: check
https_proxyand.wgetrc; try--no-proxyif the host is reachable directly. - Old server:
--secure-protocol=TLSv1_2(or another value from the manual) forces a specific version. If the server supports only TLS 1.0 or 1.1, a current OpenSSL may refuse it regardless; upgrading the server is the real fix.