in reply to SSL Certificate Verification problem, using LWP::UserAgent
As a result of the help from both of you, I believe I understand this sufficiently. One problem was that the version of Mozilla::CA I was using was too new. But Apple has thrown some additional mystery into the mix.
It turns out that OS X uses a patched version of OpenSSL. One feature of this patch is that in some cases where the certificate is going to fail, they use their own TEA code to verify. See Here for more information on their patch. This patch caused my test case to work on a similar machine. While I believed the machines to be configured similarly, I knew that there had been many Perl updates on my primary machine. Further investigation showed that the version of IO::Socket::SSL is different on the two machines (1.77 vs 2.012). The newer version has special code for OS X that overrides Apple's patch to OpenSSL. This special code caused it to fail on my main machine until I tried the older version of Mozilla::CA that has the 1024 bit key.
Thanks for the enlightenment.
|
|---|