Linuxgsm: Why instruct users to use wget --no-check-certificate when downloading lgsm?

[Flightkick]

On the server pages, for example: https://gameservermanagers.com/lgsm/dstserver/

The command that is given to the users is: wget -N --no-check-certificate https://gameservermanagers.com/dl/linuxgsm.sh && chmod +x linuxgsm.sh && bash linuxgsm.sh dstserver

Using this flag disables SSL security checks. Why is this recommended as default when downloading a script that gets to be executed?

[JimTR]

I totally agree with you ... the content should be delivered via a secure connection

[UltimateByte]

The connection is true TLS, so this argument isn't even necessary in most cases.

I believe this is here by default as a workaround for an issue with some wget versions that don't support wget redirection along with TLS, probably in Debian 7 or CentOS 6.

I just tested with my servers on Centos 7, Debian 8 and Debian 9 and didn't face the issue.

So unless there is a very good reason I cannot recall, I agree that --no-check-certificate should be removed.

If somebody with a legacy OS could test this, I'd be grateful.

[Flightkick]

I'm not familiar with the site's history but I can imagine the --no-check-certificate was added if the site has ever used Let's Encrypt (which was not added to trusted CA's for different platforms in the beginning).

If there's anyone having issues downloading without the flag you might want to have the option documented including the possible risks. It could then be removed from default instructions.

Thanks!

[UltimateByte]

Well, it seems like we pretty much wrapped the topic.
I could modify the website but since it isn't an emergency, I'll let @dgibbs64 take care of it when he can. :)

[dgibbs64]

--no-check-certificate is used for older distros that have issues with SSL. I used to get loads of people complaining they couldn't download the scripts becuase of it. the % of people with the issue may be drastically reduced by now.

[UltimateByte]

So I recalled well. :p

Well, I'll add this to the FAQ so that you can alter the website if you think it's a good idea.

[UltimateByte]

Done
https://github.com/GameServerManagers/LinuxGSM/wiki/FAQ#i-cant-download-linuxgsmsh-tlsssl-errors

[UltimateByte]

Here is why we shouldn't keep --no-check-certificate by default : https://github.com/GameServerManagers/LinuxGSM/issues/1749#issuecomment-353980472

[dgibbs64]

This issue is now resolved.

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.