LWP::UserAgent ignoring SSL_VERIFY_PEER

user_1695672 0
Viewed 951

I'm using Perl 5.16.3 on RHEL 7 and I have a fairly generic request:

#!/usr/bin/env perl
use strict;
use warnings;

use LWP::UserAgent() ;
use URI::Escape ;
use IO::Socket::SSL ;

my $PhoneNo = "<Some phone number>" ;
my $SomeMsg = "Some message" ;
my $BaseURL = 'https://api.clickatell.com/http/sendmsg?user=someuser&password=somepassword' ;
my $EncSomeMsg = uri_escape($SomeMsg) ;

my $SendURL = sprintf("%s&to=%s&text=%s",$BaseURL,$PhoneNo,$EncSomeMsg) ;

my $ua = LWP::UserAgent->new(
timeout => 10,
ssl_opts => {
    verify_hostname => 1,
    SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_PEER,
},
) ;

#$ua->ssl_opts(SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_PEER) ; # Causes error 'Can't locate object method "ssl_opts" via package "LWP::UserAgent"'

my $contents = $ua->get($SendURL) ;

printf("Returned: %s\n",$contents) ;

However it still returns:

Using the default of SSL_verify_mode of SSL_VERIFY_NONE for client is deprecated! Please set SSL_verify_mode to SSL_VERIFY_PEER possibly with SSL_ca_file|SSL_ca_path for verification. If you really don't want to verify the certificate and keep the connection open to Man-In-The-Middle attacks please set SSL_verify_mode explicitly to SSL_VERIFY_NONE in your application.

These are the versions of the modules:

  • LWP::UserAgent: 2.033
  • LWP::Protocol::https: (didn't return a version)
  • IO::Socket::SSL: 1.94

Why is it ignoring my request to verify the peer?

https perl ssl
2 Answers
user_21397660

Following on from @AnFi's suggestion, I ran yum install "perl(LWP::UserAgent)" (CPAN is not available through our firewall) and it said the relevant package perl-libwww-perl-6.05-2.el7.noarch was installed and up to date. Looking at the contents of the package I found it wasn't in the system @INC so I added this to the script:

use lib '/usr/share/perl5';

I also switched to using $ua->ssl_opts. @Steffen Ulrich's suggestion to get the versions of the relevant components also revealed that LWP::Protocol::https wasn't installed, and once it was then the script worked fine without complaining.

user_16956720
Related