download.kiwix.org ZIM file downloads often fail: "ERROR: cannot verify ftpmirror.your.org's certificate"

[holta]

Example:

wget http://download.kiwix.org/zim/wiktionary/wiktionary_en_simple_all_maxi_2021-03.zim

--2021-04-24 17:01:12--  http://download.kiwix.org/zim/wiktionary/wiktionary_en_simple_all_maxi_2021-03.zim
Resolving download.kiwix.org (download.kiwix.org)... 195.154.156.115
Connecting to download.kiwix.org (download.kiwix.org)|195.154.156.115|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://ftpmirror.your.org/pub/kiwix/zim/wiktionary/wiktionary_en_simple_all_maxi_2021-03.zim [following]
--2021-04-24 17:01:12--  https://ftpmirror.your.org/pub/kiwix/zim/wiktionary/wiktionary_en_simple_all_maxi_2021-03.zim
Resolving ftpmirror.your.org (ftpmirror.your.org)... 204.9.55.82, 2001:4978:1:420::cc09:3752
Connecting to ftpmirror.your.org (ftpmirror.your.org)|204.9.55.82|:443... connected.
ERROR: cannot verify ftpmirror.your.org's certificate, issued by ‘CN=R3,O=Let's Encrypt,C=US’:
  Unable to locally verify the issuer's authority.
To connect to ftpmirror.your.org insecurely, use `--no-check-certificate'.

Command-line folks can of course use --no-check-certificate

But others (general users) end up completely stuck!

[kelson42]

@holta Thank you!

ftpmirror.kiwix.org TL is wrongly configured. I have written to the mirror admin.

This might explain offspot/kiwix-hotspot#563

[rgaudin]

Nope, in this issue downloads starts then fail so it's not using this failing mirror.
Unless aria uses the pré-redirect url when requesting multiparts which I highly doubt.
Also, in this case errors should be much more often and earlier in the download.
finally, given geographic the card shop always gets our french mirror.

[kelson42]

The broken TLS configuraiton has been fixed upstream. @holta should work for you now.