I know that the server is expecting a certificate to be sent back....
You've got it a little backward. If it is a "secure server" (in other words, one that handles SSL,) then the server will have a certificate installed. The certificate will be signed by a "certificate authority" or CA. The CA will either be a known and generally trusted third party such as Verisign or Thawte or it could be an unknown such as the company that owns the server itself.
You could theoretically have an encrypted conversation with a server without requiring a certificate at all. The problem is that you wouldn't know the server was really the server you wanted to communicate with, and that's not very secure afterall, is it? The certificate essentially says, "this is really www.example.com." Since servers don't usually care who is talking to them, there is no reason to try to verify it the other way around. That's why you, as the client, probably don't need a certificate. (There are rare exceptions to this.) That's also why locally signed certificates shouldn't be used for anything but testing (or internal to an organization.)
LWP works just fine with SSL as long as you have configured it to when compiling and have the proper libraries. Read the documentation for more information.
Update: If you are really in a situation where client authentication is required, then you should ask the owner of the server what the requirements are. Depending on the CA(s) that that the server trusts you may have to be issued one or you may have to purchase one.
-sauoq
"My two cents aren't worth a dime.";
|