Bug#748740: Update

[Rajesh Deo]

Thanks to further information shared by Jakub Wilk,
specifically the issue discussion being tracked here:

https://github.com/libwww-perl/lwp-protocol-https/pull/14

I was able to resolve connection issues with servers containing
self-signed SSL (localized dev servers)  using following method:

Based on information in above link and a small patch to lwp-protocol-https
as shown in link below:

https://github.com/libwww-perl/lwp-protocol-https/pull/14#issuecomment-42950342

This fixes the real issue of $ssl_opt{ssl_verify_mode} getting clobbered
and
causing the failed connections to self-signed servers. While the fix is
meant
for versions < 1.950, it also work in 1.988-1.

I can now ignore setting both environment variables:

PERL_LWP_SSL_VERIFY_HOSTNAME
and  PERL_LWP_SSL_CA_PATH

I instead opted to modify the library code my client-side tool depends on
where LWP is being called and introduced a single option
to specify accepting connections to self-signed servers.

As noted by Jakub this is done with:

$ua->ssl_opts( SSL_verify_mode => 0, verify_hostname => 0, );

So for me the fix was two-fold, avoid clobbering of ssl_verify_mode in
lwp-protocol-https
and set above options if connecting to self-signed SSL servers.

With the clobbering part fixed other things such as GET/POST from LWP also
work.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.alioth.debian.org/pipermail/pkg-perl-maintainers/attachments/20140525/778c81eb/attachment.html>