I have an API package on CRAN that provides an interface with a United Nations DB (link to UN site), it's built using httr, which uses the curl package. I discovered yesterday that the core functions of my package were no longer working properly on Windows machines, they all fail with the error message:
Error in curl::curl_fetch_memory(url, handle = handle) :
Peer certificate cannot be authenticated with given CA certificates
Which basically means there's a CA certificate issue preventing curl from completing the connection. After looking into this a bit, I believe the UN site hosting the DB is the issue, its SSL certificate is invalid per ssldecoder (see this link).
One easy fix to circumvent this issue is to add param ssl_verifypeer = FALSE to all calls to httr::GET(). However this is not an ideal solution for security reasons, since it bascially tells curl to make the connection regardless of the validity of the site's certificate.
My question is, what is the consensus on using this parameter within a CRAN package? Keeping in mind that the UN website is (presumably) safe?