When I run package-refresh-contents after running toggle-debug-on-error I get the following backtrace:

Debugger entered--Lisp error: (gnutls-error #<process elpa.gnu.org> -50)
  signal(gnutls-error (#<process elpa.gnu.org> -50))
  package--download-one-archive(("gnu" . "https://elpa.gnu.org/packages/") "archive-contents" nil)
  call-interactively(package-refresh-contents record nil)
  command-execute(package-refresh-contents record)
  execute-extended-command(nil "package-refresh-contents" "package-ref")
  funcall-interactively(execute-extended-command nil "package-refresh-contents" "package-ref")
  call-interactively(execute-extended-command nil nil)

Taking reference from the discussion found here I tried the following steps:

Running M-: (gnutls-available-p) produces:

(ClientHello\ Padding Session\ Ticket Extended\ Master\ Secret Encrypt-then-MAC ClientHello\ Padding ALPN Heartbeat SRTP Signature\ Algorithms SRP Supported\ ECC\ Point\ Formats Negotiated\ Groups ...)

Running shell command gnutls-cli -p 443 elpa.gnu.org from Emacs produces:

'gnutls-cli' is not recognized as an internal or external command, operable program or batch file.

Value of the variable gnutls-trustfiles is:

("/etc/ssl/certs/ca-certificates.crt" "/etc/pki/tls/certs/ca-bundle.crt" "/etc/ssl/ca-bundle.pem" "/usr/ssl/certs/ca-bundle.crt" "/usr/local/share/certs/ca-root-nss.crt" "/etc/ssl/cert.pem")

Added paths of ssl/cert.pem and ssl/certs/ca-bundle.crt in Emacs' installation directory to the gnutls-trustfiles variable. In my case they're c:/Program Files/emacs/ssl/cert.pem and c:/Program Files/emacs/ssl/certs/ca-bundle.crt. Running package-refresh-contents after saving from the variable customization menu and running eval-buffer still produces the same error. Restarting Emacs also produces the same error.

On MS-Windows Emacs is supposed to use the system certificate store through MS-Windows native interfaces. No additional certificates in a separate bundle should be needed. So either your GnuTLS version has a bug of some kind, or your Windows system lacks some updates, or there's a genuine problem with ELPA's certificates.

Emacs version is "GNU Emacs 26.3 (build 1, x86_64-w64-mingw32) of 2019-08-29"

1 Answer 1


I solved this by setting the variable gnutls-algorithm-priority to TLS-1.2.

(setq gnutls-algorithm-priority "NORMAL:-VERS-TLS1.2"). 

It's because on Windows or Windows Subsystem Linux (WSL) the local gnutls-utils may not support TLS1.3.

  • I believe that sets it to allow everything except for TLS 1.2. May 10, 2020 at 15:14

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .