1

My application requires LWP under SSL, but I can't seem to get it to connect properly without receiving an error.

certificate verify failed)LWP::Protocol::https::Socket: SSL connect attempt failed with unknown error error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed at C:/Perl/site/lib/LWP/Protocol/http.pm line 51.

Whenever I load up the website in FireFox on my server, I receive

This connection is untrusted (Technical error: sec_error_unknown_issuer)

Whenever I load it up in Chrome, it verifies absolutely fine.

I can load the page up in FireFox and Chrome on my computer and receive no SSL verification errors at all.

I have no clue what is different between my PC and my server; they're both using the exact same FireFox versions so I'm not sure why it wouldn't verify properly on there.

I've tried workarounds by putting in $ENV{PERL_LWP_SSL_VERIFY_HOSTNAME} = 0 in the Perl script but it seems to throw the same exact error still.

This is the script I'm using to test HTTPS

Does anyone know any solution to this or any workaround?

i alarmed alien
  • 9,412
  • 3
  • 27
  • 40
diginet
  • 38
  • 6
  • Possibly related: http://stackoverflow.com/questions/19389336/installing-a-new-ca-certificate-for-perl-5-14-2-lwp-on-ubuntu-12-04, http://stackoverflow.com/questions/6384217/failed-connect-or-certificate-verify-failed-on-lwp-https-get – i alarmed alien Oct 10 '14 at 21:28

1 Answers1

3

I've tried workarounds by putting in $ENV{PERL_LWP_SSL_VERIFY_HOSTNAME} = 0

As the name of the option implies it cares only about disabling the check of the hostname against the certificate. It does not disable the validation of the certificate chain.

Whenever I load up the website in FireFox on my server, I receive ...

Since you get validation errors with Firefox and LWP but not with Chrome, Chrome has probably an additional CA as trusted which they others don't have.

From your code it looks like that you are using Windows and from my understanding Firefox comes with its own CA store, LWP uses Mozilla::CA (which contains the CAs usually shipped with Firefox) but Chrome uses the system CA store. Thus there is probably a CA in the system store which Firefox and LWP don't know about.

While it might be that there is some special esoteric CA which is known to the default Windows CA store but not to Firefox, it is more likely that you are behind some SSL inspecting firewall and that the administrators added the necessary proxy certificate to Windows CA store but not to Firefox or LWP's store. I would suggest you check the certificate chain inside the Chrome browser and look at the top (builtin) certificate.

If you consider the CA trusted you might export it and import it into Firefox. You might also make LWP use this CA by saving it in PEM format and then set the PERL_LWP_SSL_CA_PATH environment variable to point to the saved file or use the SSL_ca_path option in the ssl_opts setting to make LWP use this CA certificate for validation.

If this explanation does not lead to a solution please provide more details about the target URL you are trying to access and the network setup you have, especially if there is a SSL intercepting proxy or firewall. Please provide also information about the version of LWP you are using, because there changed a lot with version 6.

Steffen Ullrich
  • 114,247
  • 10
  • 131
  • 172