[lmi] wget: "Unable to establish SSL connection"

[Greg Chicares]

I wanted to create a brand-new chroot on our corporate server,
but the 'lmi_setup*.sh' scripts rely on fetching the latest
versions of various files using 'wget', and today we encounter
seemingly random 'wget' failures. Is there anything I should
try beyond the options demonstrated below? I'd rather not
rewrite the scripts, but maybe there's no choice.

Here's an example seen when I ran the top-level script:

wget -N -nv "${GIT_URL_BASE}"/gwc/.vim/spell/en.utf-8.add
+ wget -N -nv 
https://github.com/let-me-illustrate/lmi/raw/master/gwc/.vim/spell/en.utf-8.add
Last-modified header missing -- time-stamps turned off.
2021-04-06 09:47:24 
URL:https://raw.githubusercontent.com/let-me-illustrate/lmi/master/gwc/.vim/spell/en.utf-8.add
 [3504/3504] -> "en.utf-8.add" [1]
chmod 0644 .zshrc .vimrc en.utf-8.add
+ chmod 0644 .zshrc .vimrc en.utf-8.add
wget -N -nv "${GIT_URL_BASE}"/install_msw.sh
+ wget -N -nv https://github.com/let-me-illustrate/lmi/raw/master/install_msw.sh
Unable to establish SSL connection.

Rerunning the script, I get the same
  "Unable to establish SSL connection"
error on other files. Sometimes it terminates earlier; sometimes, later.
There's nothing special about 'install_msw.sh': sometimes it gets
downloaded, sometimes not.

I tried running one particular 'wget' command with various options, in
the hope of discovering some voodoo that works, but they all fail at
least sometimes. Failing examples:

 # HTTP instead of HTTPS

/srv/cache_for_lmi/logs[0]$wget -N -nv 
http://github.com/let-me-illustrate/lmi/raw/master/install_msw.sh
Unable to establish SSL connection.

 # --no-check-certificate

/srv/cache_for_lmi/logs[0]$wget -N -nv --no-check-certificate 
https://github.com/let-me-illustrate/lmi/raw/master/install_msw.sh
Unable to establish SSL connection.

 # obsolete protocol (this one always fails)

/srv/cache_for_lmi/logs[4]$wget -N -nv --secure-protocol=TLSv1 
https://github.com/let-me-illustrate/lmi/raw/master/install_msw.sh
OpenSSL: error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol 
version
Unable to establish SSL connection.

 # --no-check-certificate and HTTP

/srv/cache_for_lmi/logs[0]$wget -N -nv --no-check-certificate 
http://github.com/let-me-illustrate/lmi/raw/master/install_msw.sh
Unable to establish SSL connection.

 # --retry-connrefused (apparently doesn't retry SSL failures)

/srv/cache_for_lmi/logs[0]$wget -N -nv --retry-connrefused 
https://github.com/let-me-illustrate/lmi/raw/master/install_msw.sh
Unable to establish SSL connection.

 # --no-dns-cache

/srv/cache_for_lmi/logs[0]$wget -N -nv --no-dns-cache 
https://github.com/let-me-illustrate/lmi/raw/master/install_msw.sh
Unable to establish SSL connection.

If there's really no other choice than to rewrite the scripts,
which approach seems best:
 - Establish a local cache directory for all files that are
   downloaded by wget; then run a script to refresh all of
   them, until all finally get refreshed? Just writing that
   idea down makes it seem clearly poor.
 - Use 'curl' instead of 'wget'.
 - Use git. All the files to be downloaded are in git. It
   seems that git works reliably where wget fails. It seems
   wasteful to clone a whole repository just to fetch a
   few scripts, but that's okay if it solves the problem.