<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html;
      charset=windows-1252">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    <div class="moz-cite-prefix">Norbert Preining wrote:<br>
    </div>
    <blockquote type="cite"
      cite="mid:20200409223144.GA11298@burischnitzel.preining.info">
      <pre wrap="">On Thu, 09 Apr 2020, Philip Taylor wrote:
</pre>
      <blockquote type="cite">
        <blockquote type="cite">
          <pre wrap="">OpenSSL: error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol
 version
Unable to establish SSL connection.
</pre>
        </blockquote>
      </blockquote>
      <pre wrap="">
As I said, one of your "special" setups. It is a normal and valid
Let's Encrypt certificate, like billions others.
</pre>
    </blockquote>
    <br>
    There is <i>nothing</i> <i>whatsoever </i> to suggest that this
    has anything to do with my personal preferences for the location of
    the various TeX-MF directories, which is the only part of the
    installation that I modify  Everything else is out of the box.<br>
    Here is a simple console session which demonstrates that "wget" can
    access secure sites only if "--no-check-certificate" is specified,
    which is not one of the options specified in the TLMGR call thereof 
    :<br>
    <br>
    <blockquote type="cite">D:downloading <a
        class="moz-txt-link-freetext"
        href="https://texlive.info/tlpretest//tlpkg/texlive.tlpdb.xz">https://texlive.info/tlpretest//tlpkg/texlive.tlpdb.xz</a>
      using wget<br>
      --user-agent=texlive/wget --tries=4 --timeout=30 -q -O</blockquote>
    <br>
    Is there perhaps a tacit assumption that the users "wgetrc" file
    will contain "--no-check-certificate" ?<br>
    <br>
    Simple demo of command-line WGET to secure location without and with
    "--no-check-certificate" —<br>
    <br>
    <blockquote type="cite">D:\temp>wget -r
      <a class="moz-txt-link-freetext" href="http://tinyurl.com/quick-search/">http://tinyurl.com/quick-search/</a><br>
      SYSTEM_WGETRC = c:/progra~1/wget/etc/wgetrc<br>
      syswgetrc = C:\Program files (x86)\GnuWin32/etc/wgetrc<br>
      --2020-04-10 10:30:09--  <a class="moz-txt-link-freetext" href="http://tinyurl.com/quick-search/">http://tinyurl.com/quick-search/</a><br>
      Resolving tinyurl.com... 104.20.57.30, 104.20.58.30<br>
      Connecting to tinyurl.com|104.20.57.30|:80... connected.<br>
      HTTP request sent, awaiting response... 301 Moved Permanently<br>
      Location:
      <a class="moz-txt-link-freetext" href="https://cse.google.com/cse?cx=018439384481867961395:wcjja5tdch6">https://cse.google.com/cse?cx=018439384481867961395:wcjja5tdch6</a>
      [follo<br>
      wing]<br>
      --2020-04-10 10:30:09-- 
      <a class="moz-txt-link-freetext" href="https://cse.google.com/cse?cx=018439384481867961395:wcj">https://cse.google.com/cse?cx=018439384481867961395:wcj</a><br>
      ja5tdch6<br>
      Resolving cse.google.com... 172.217.169.46<br>
      Connecting to cse.google.com|172.217.169.46|:443... connected.<br>
      ERROR: cannot verify cse.google.com's certificate, issued by
      `/C=US/O=Google Tru<br>
      st Services/CN=GTS CA 1O1':<br>
        Unable to locally verify the issuer's authority.<br>
      To connect to cse.google.com insecurely, use
      `--no-check-certificate'.<br>
      Unable to establish SSL connection.<br>
      <br>
      D:\temp>D:\temp>wget -r <a class="moz-txt-link-freetext" href="http://tinyurl.com/quick-search/">http://tinyurl.com/quick-search/</a><br>
      SYSTEM_WGETRC = c:/progra~1/wget/etc/wgetrc<br>
      syswgetrc = C:\Program files (x86)\GnuWin32/etc/wgetrc<br>
      --2020-04-10 10:30:09--  <a class="moz-txt-link-freetext" href="http://tinyurl.com/quick-search/">http://tinyurl.com/quick-search/</a><br>
      Resolving tinyurl.com... 104.20.57.30, 104.20.58.30<br>
      Connecting to tinyurl.com|104.20.57.30|:80... connected.<br>
      HTTP request sent, awaiting response... 301 Moved Permanently<br>
      Location:
      <a class="moz-txt-link-freetext" href="https://cse.google.com/cse?cx=018439384481867961395:wcjja5tdch6">https://cse.google.com/cse?cx=018439384481867961395:wcjja5tdch6</a>
      [follo<br>
      wing]<br>
      --2020-04-10 10:30:09-- 
      <a class="moz-txt-link-freetext" href="https://cse.google.com/cse?cx=018439384481867961395:wcj">https://cse.google.com/cse?cx=018439384481867961395:wcj</a><br>
      ja5tdch6<br>
      Resolving cse.google.com... 172.217.169.46<br>
      Connecting to cse.google.com|172.217.169.46|:443... connected.<br>
      ERROR: cannot verify cse.google.com's certificate, issued by
      `/C=US/O=Google Tru<br>
      st Services/CN=GTS CA 1O1':<br>
        Unable to locally verify the issuer's authority.<br>
      To connect to cse.google.com insecurely, use
      `--no-check-certificate'.<br>
      Unable to establish SSL connection.<br>
    </blockquote>
    <br>
    <blockquote type="cite"><br>
      D:\temp>wget -r <a class="moz-txt-link-freetext" href="http://tinyurl.com/quick-search/">http://tinyurl.com/quick-search/</a>
      --no-check-certificate<br>
      SYSTEM_WGETRC = c:/progra~1/wget/etc/wgetrc<br>
      syswgetrc = C:\Program files (x86)\GnuWin32/etc/wgetrc<br>
      --2020-04-10 10:32:08--  <a class="moz-txt-link-freetext" href="http://tinyurl.com/quick-search/">http://tinyurl.com/quick-search/</a><br>
      Resolving tinyurl.com... 104.20.57.30, 104.20.58.30<br>
      Connecting to tinyurl.com|104.20.57.30|:80... connected.<br>
      HTTP request sent, awaiting response... 301 Moved Permanently<br>
      Location:
      <a class="moz-txt-link-freetext" href="https://cse.google.com/cse?cx=018439384481867961395:wcjja5tdch6">https://cse.google.com/cse?cx=018439384481867961395:wcjja5tdch6</a>
      [follo<br>
      wing]<br>
      --2020-04-10 10:32:08-- 
      <a class="moz-txt-link-freetext" href="https://cse.google.com/cse?cx=018439384481867961395:wcj">https://cse.google.com/cse?cx=018439384481867961395:wcj</a><br>
      ja5tdch6<br>
      Resolving cse.google.com... 172.217.169.46<br>
      Connecting to cse.google.com|172.217.169.46|:443... connected.<br>
      WARNING: cannot verify cse.google.com's certificate, issued by
      `/C=US/O=Google T<br>
      rust Services/CN=GTS CA 1O1':<br>
        Unable to locally verify the issuer's authority.<br>
      HTTP request sent, awaiting response... 200 OK<br>
      Length: unspecified [text/html]<br>
      Saving to:
      `cse.google.com/cse@cx=018439384481867961395%3Awcjja5tdch6'<br>
      <br>
          [ <=>                                   ] 2,555      
      --.-K/s   in 0s<br>
      <br>
      2020-04-10 10:32:09 (10.4 MB/s) -
      `cse.google.com/cse@cx=018439384481867961395%3<br>
      Awcjja5tdch6' saved [2555]<br>
      <br>
      FINISHED --2020-04-10 10:32:09--<br>
      Downloaded: 1 files, 2.5K in 0s (10.4 MB/s)</blockquote>
    <br>
    <br>
    <br>
  </body>
</html>