Del Simmons wrote:
>
> Hey guys,
>
> Sorry if this has been answered already. I'm using LWP to post data to a
> https server. The client cert and key is passed properly and the server
> verify's me fine when I submit my POST, but I always get the following
> warning header from LWP/Protocol/https.pm: "Client-SSL-Warning: Peer
> certificate not verified". After seeing a post by Lutz Jaenicke, it
> seems that the bottom line is that Crypt::SSLeay doesn't support the
> certificate verification process.
>
Crypt::SSLeay does support peer cert verification via
environment variable configuration. But, you will still
end up with the Client-SSL-Warning, as that it automatically
set in the LWP layer.
# CA CERT PEER VERIFICATION
$ENV{HTTPS_CA_FILE} = 'certs/ca.crt';
$ENV{HTTPS_CA_DIR} = 'certs/';
The perl XS code looks like:
SSL_CTX_set_verify(ctx)
...
CAfile=getenv("HTTPS_CA_FILE");
CAdir =getenv("HTTPS_CA_DIR");
if(!CAfile && !CAdir) {
SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL);
} else {
SSL_CTX_load_verify_locations(ctx,CAfile,CAdir);
SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
}
I believe that when the CA verification is occuring,
there will be an error if the CA cert is not verified.
You can use the ./net_ssl_test script with a special
argument -CAfile, perldoc Crypt::SSLeay for more info,
and check out the CERT section.
--Josh
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
