in reply to Re: https using lwp (WWW::Mechanize)
in thread https using lwp

Hi. The certificate is a self signed certificate from a private server.

Replies are listed 'Best First'.
Re^3: https using lwp (WWW::Mechanize)
by noxxi (Pilgrim) on Nov 19, 2016 at 08:27 UTC

    The easiest way to deal with self-signed certificates is to expect exactly this certificate. This can be done with the SSL_fingerprint argument of IO::Socket::SSL which you can set using ssl_opts in LWP. With this argument all other checks (subject matches hostname, expiration...) are disabled.
    You need at least IO::Socket::SSL version 1.980 for this (released 04/2014). See the documentation of SSL_fingerprint for details but in short:

    To get the current fingerprint analyze the servers certificate or get the fingerprint from a trusted location with:

    use IO::Socket::SSL; my $cl = IO::Socket::SSL->new( PeerAddr => "ip:port", SSL_verify_mode => 0 ); print $cl->get_fingerprint."\n"; # sha256$b64d26746ca1cd5403....

    And to use it:

    my $ua = LWP::UserAgent->new... $ua->ssl_opts(SSL_fingerprint => 'sha256$b64...');
Re^3: https using lwp (WWW::Mechanize)
by Anonymous Monk on Nov 19, 2016 at 08:01 UTC

    Hi. The certificate is a self signed certificate from a private server.

    I think that is your problem, see https://metacpan.org/pod/IO::Socket::SSL#Common-Problems-with-SSL it says

    Validation of self-signed certificate fails even if it is given with SSL_ca* argument.

    The SSL_ca* arguments do not give a general trust store for arbitrary certificates but only specify a store for CA certificates which then can be used to verify other certificates. This especially means that certificates which are not a CA get simply ignored, notably self-signed certificates which do not also have the CA-flag set.

    This behavior of OpenSSL differs from the more general trust-store concept which can be found in browsers and where it is possible to simply added arbitrary certificates (CA or not) as trusted.

    So, one path towards a solution, figure out what CA-flag is and how to set it , openssl stuff

    Or maybe you can get a free one care of mozilla Let's Encrypt - Free SSL/TLS Certificates