When I run package-refresh-contents after running toggle-debug-on-error I get the following backtrace:

Debugger entered--Lisp error: (gnutls-error #<process elpa.gnu.org> -50)
  signal(gnutls-error (#<process elpa.gnu.org> -50))
  package--download-one-archive(("gnu" . "https://elpa.gnu.org/packages/") "archive-contents" nil)
  call-interactively(package-refresh-contents record nil)
  command-execute(package-refresh-contents record)
  execute-extended-command(nil "package-refresh-contents" "package-ref")
  funcall-interactively(execute-extended-command nil "package-refresh-contents" "package-ref")
  call-interactively(execute-extended-command nil nil)

Taking reference from the discussion found here I tried the following steps:

Running M-: (gnutls-available-p) produces:

(ClientHello\ Padding Session\ Ticket Extended\ Master\ Secret Encrypt-then-MAC ClientHello\ Padding ALPN Heartbeat SRTP Signature\ Algorithms SRP Supported\ ECC\ Point\ Formats Negotiated\ Groups ...)

Running shell command gnutls-cli -p 443 elpa.gnu.org from Emacs produces:

'gnutls-cli' is not recognized as an internal or external command, operable program or batch file.

Value of the variable gnutls-trustfiles is:

("/etc/ssl/certs/ca-certificates.crt" "/etc/pki/tls/certs/ca-bundle.crt" "/etc/ssl/ca-bundle.pem" "/usr/ssl/certs/ca-bundle.crt" "/usr/local/share/certs/ca-root-nss.crt" "/etc/ssl/cert.pem")

Added paths of ssl/cert.pem and ssl/certs/ca-bundle.crt in Emacs' installation directory to the gnutls-trustfiles variable. In my case they're c:/Program Files/emacs/ssl/cert.pem and c:/Program Files/emacs/ssl/certs/ca-bundle.crt. Running package-refresh-contents after saving from the variable customization menu and running eval-buffer still produces the same error. Restarting Emacs also produces the same error.

On MS-Windows Emacs is supposed to use the system certificate store through MS-Windows native interfaces. No additional certificates in a separate bundle should be needed. So either your GnuTLS version has a bug of some kind, or your Windows system lacks some updates, or there's a genuine problem with ELPA's certificates.

Emacs version is "GNU Emacs 26.3 (build 1, x86_64-w64-mingw32) of 2019-08-29"


I solved this by setting the variable gnutls-algorithm-priority to TLS-1.2.

(setq gnutls-algorithm-priority "NORMAL:-VERS-TLS1.2"). 

It's because on Windows or Windows Subsystem Linux (WSL) the local gnutls-utils may not support TLS1.3.

  • I believe that sets it to allow everything except for TLS 1.2. – Michael Hoffman May 10 '20 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.