Skip Menu |

This queue is for tickets about the Net-SSLGlue CPAN distribution.

Report information
The Basics
Id: 57367
Status: resolved
Priority: 0/
Queue: Net-SSLGlue

People
Owner: Nobody in particular
Requestors: PMOONEY [...] cpan.org
Cc:
AdminCc:

Bug Information
Severity: (no value)
Broken in: (no value)
Fixed in: (no value)



Subject: Requested doc addition
In my usage the certificate had a CN of *.givex.com, so the host dev-gapi.givex.com matched. However it was not an exact match so I had to use this config: local $Net::SSLGlue::LWP::SSLopts{SSL_ca_file} = '/path/to/file'; $Net::SSLGlue::LWP::SSLopts{SSL_verifycn_scheme} = { wildcards_in_cn => 'anywhere', check_cn => 'when_only' } That way the certificate was validated correctly. With out this I could not connect and it took me a while to figure out what was wrong.
The documentation says explicitly, that the SSL_verfify_scheme 'https' is used which is the right choice for https connection. According to RFC 2818 this scheme does not allow wildcards in CN, only in subjectAltNames. Nevertheless I've added an example to the documentation in 0.2_1 which shows how to override the scheme, not without pointing out that overriding should only be necessary for certificates which are used against the specification in the RFC.