Skip Menu |

This queue is for tickets about the REST-Client CPAN distribution.

Report information
The Basics
Id: 105645
Status: resolved
Priority: 0/
Queue: REST-Client

People
Owner: KKANE [...] cpan.org
Requestors: david.imbs [...] open-groupe.com
Cc:
AdminCc:

Bug Information
Severity: (no value)
Broken in: (no value)
Fixed in: 273



Subject: [proposition] CA-File for just server validation
Date: Fri, 3 Jul 2015 16:24:43 +0200
To: <bug-REST-Client [...] rt.cpan.org>
From: "IMBS David" <david.imbs [...] open-groupe.com>
Hello, I’m currently using REST::Client and I’ve got some trouble to use SSL properly. On a server, I have a valid key and cert for a ca certifcate on my local client. I create a client rest with ca option : REST::Client->new ( … , ca => ‘/path/to/ca.cert.pem’ ); It wasn’t working until I change REST/Client.pm => @362 #prime LWP with ssl certfile if we have values if($self->getCert){ carp "REST::Client exception: Certs defined but not using https" unless $url =~ /^https/; croak "REST::Client exception: Cannot read cert and key file" unless -f $self->getCert && -f $self->getKey; $ua->ssl_opts(SSL_cert_file => $self->getCert); $ua->ssl_opts(SSL_key_file => $self->getKey); - if(my $ca = $self->getCa){ - croak "REST::Client exception: Cannot read CA file" unless -f $ca; - $ua->ssl_opts(SSL_ca_file => $ca); - } } + + if(my $ca = $self->getCa){ + croak "REST::Client exception: Cannot read CA file" unless -f $ca; + $ua->ssl_opts(SSL_ca_file => $ca); + } Maybe I’m wrong about it, but that seems more logical this way. Regards, David IMBS Alternant Concepteur Développeur Informatique Tél : 02.99.12.71.71 Fax : 02.99.12.71.72 12 L Rue du Patis Tatelin – 35700 RENNES <mailto:david.imbs@open-groupe.com> david.imbs@open-groupe.com Description : cid:image002.gif@01CFCB5E.584F7380
Download image001.gif
image/gif 11.9k
image001.gif
This makes a lot of sense. I will look at rolling this into some changes I am working on, but this should be separated so you can do hostname verification without X509 authentication. Thanks for the bug report, Kevin
CA file has been split out so hostname verification can be done independently of specifying SSL cert and key. Fixed in version 273. Thanks, Kevin