adding the SSL_verifycn_name option fixed it!

also, from your "# URL does not contain the correct name" comment I got that LWP tries to automatically derive this from the url if it contains a domain name and not just the ip.

To test this I swapped the ip for the domain name (which I originally did not do because it does not resolve to the internal ip and hence does not use the direct route). This also allowed it to work, even without directly specifying the cn via ssl_opts.

I'd like to thank you and all the other monks who helped to resolve this problem!

It is annoying to see how so much time can go into finding that you just need one extra option for your connection...