rsx491 has asked for the wisdom of the Perl Monks concerning the following question:

After installing this thread's version (http://www.perlmonks.org/?node_id=1096884) of io/sock/ssl (https://github.com/noxxi/p5-io-socket-ssl), I'm still getting the same error "DEBUG: .../IO/Socket/SSL.pm:1483: local error: Could not retrieve peer certificate". I'm attempting to retrieve the browsers certificate data. This is for a smart card project where users are identified by their certificates, specifically their subjectAltName.

use strict; use warnings; use IO::Socket::SSL qw/debug4/; my $addr = "\0\0\0\0:1235"; my $key_file = './certs/key.pem'; my $cert_file = './certs/certificate.pem'; my $ioclass = IO::Socket::SSL->can_ipv6 || 'IO::Socket::INET'; my $server = $ioclass->new( Listen => 5, LocalAddr => $addr, Reuse => 1, ) or die "failed to create SSL server at $addr: $!"; my $ctx = IO::Socket::SSL::SSL_Context->new( SSL_server => 1, SSL_cert_file => $cert_file, SSL_key_file => $key_file, SSL_verify_mode => 0 ) or die "cannot create context: $SSL_ERROR"; while (1) { warn "waiting for next connection.\n"; my $cl = $server->accept or do { warn "failed to accept: $!\n"; next; }; IO::Socket::SSL->start_SSL($cl, SSL_server => 1, SSL_reuse_ctx => +$ctx) or do { warn "ssl handshake failed: $SSL_ERROR\n"; next; }; if ( $cl->peer_certificate ) { warn "new SSL connection with client certificate\n". "\tsubject=".$cl->peer_certificate('subject')."\n". "\tissuer=".$cl->peer_certificate('issuer')."\n" } else { warn "new SSL connection without client certificate\n" } print $cl "connected with cipher=".$cl->get_cipher." version=".$cl +->get_sslversion."\n"; }

Replies are listed 'Best First'.
Re: Could not retrieve peer certificate - io/sock/ssl
by ww (Archbishop) on Jul 05, 2015 at 12:23 UTC

    Make it easy for us to help you. Post your code (40 some lines, it seems) here rather than linking to an external source.

      any ideas?
Re: Could not retrieve peer certificate - io/sock/ssl
by noxxi (Pilgrim) on Jul 08, 2015 at 21:20 UTC
    If you want to get a certificate from the client you must not disable validation but set SSL_verify_mode to SSL_VERIFY_PEER. Otherwise the underlying SSL stack will not request a certificate from the client and the client will not send anything if not requested.