PastisALo has asked for the wisdom of the Perl Monks concerning the following question:

I have a script that fetch https://whatever.com/data with LWP::UserAgent. How may I know if the SSL certificate for whatever.com has expired. with curl I got a message saying so, but perl seems insentivite to this security aspect.(at first look) I prefer my perl script but I would like to know how to verify the certificate.

Replies are listed 'Best First'.
Re: Certificate and SSL question
by PodMaster (Abbot) on Feb 11, 2004 at 09:34 UTC
    update:read http://www.mail-archive.com/libwww@perl.org/msg04214.html

    Take a look inside LWP::Protocol::https. It appears that some extra headers would be set, although I can't say definitively since ... and i'm right. It appears Client-SSL-Warning: Peer certificate not verified is set, so just check for it in the response object (this warning would probably be issued on self signed certificates as well, so for additional info, you'd turn to something like Crypt::SSLeay).

    Here's a nice debug technique :) 

    lwp-request -USex https://selfcare.mana.pf/

LWP::UserAgent::new: ()
LWP::UserAgent::request: ()
LWP::UserAgent::send_request: GET https://selfcare.mana.pf/
LWP::UserAgent::_need_proxy: Not proxied
LWP::Protocol::http::request: ()
LWP::Protocol::collect: read 621 bytes
LWP::Protocol::collect: read 2052 bytes
LWP::UserAgent::request: Simple response: OK
GET https://selfcare.mana.pf/
User-Agent: lwp-request/2.06

GET https://selfcare.mana.pf/ --> 200 OK
Connection: close
Date: Wed, 11 Feb 2004 09:32:56 GMT
Accept-Ranges: bytes
ETag: "17f7d-a71-3ed3c20c;3ed3c4c5"
Server: Apache/1.3.27 (Unix) mod_ssl/2.8.14 OpenSSL/0.9.7b
Vary: negotiate,accept-language,accept-charset
Content-Language: en
Content-Length: 2673
Content-Location: index.html.en
Content-Type: text/html
Last-Modified: Tue, 27 May 2003 19:52:44 GMT
Client-Date: Wed, 11 Feb 2004 09:36:07 GMT
Client-Peer: 202.3.225.54:443
Client-Response-Num: 1
Client-SSL-Cert-Issuer: /C=XY/ST=Snake Desert/L=Snake Town/O=Snake Oil
+, Ltd/OU=Certificate Authority/CN=Snake Oil CA/ema
ilAddress=ca@snakeoil.dom
Client-SSL-Cert-Subject: /C=PF/ST=Tahiti/L=Tahiti/O=MANA S.A./OU=ISP/C
+N=www.mana.pf/emailAddress=admin@mana.pf
Client-SSL-Cipher: DHE-RSA-AES256-SHA
Client-SSL-Warning: Peer certificate not verified
TCN: choice
Title: Test Page for the SSL/TLS-aware Apache Installation on Web Site

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">

    [download]
    I hope that helps. A thanks to dominix for the website with invalid date on certificate.

    MJD says "you can't just make shit up and expect the computer to know what you mean, retardo!"
    I run a Win32 PPM repository for perl 5.6.x and 5.8.x -- I take requests (README).
    ** The third rule of perl club is a statement of fact: pod is sexy.

[reply]
[d/l]

Back to Seekers of Perl Wisdom