| Subject: | "certificate verify failed" with default settings |
In 0.8.22 the case of the 'tls_allowed' attribute was fixed, so the default of 1 is actually effective.
But this fix has a problem (besides the fact that the POD still has the upper case 'TLS_allowed'):
With this setting, and given that TLS is supported, IO::Socket::SSL tries a hostname verification and for this it needs a ca file which is not found (unless by chance there is a file in 'certs/my-ca.pem').
This in turn leads to a not very informative error message:
"Failed to send the message: Connection not established" when trying to send a message in Mail::Sender.
So, I think it would be helpful to
- fix the documentation to at least make it easy to switch TLS off (tls_allowed => 0, not TLS_allowed)
- either allow a parameter to pass the ca_file and/or default e.g. to Mozilla::CA::SSL_ca_file() if Mozilla::CA is installed, else give a hint that it won't work without a ca_file as long as tls_allowed is switched on.
- if it still failes, give a better error message. While debugging I inserted a die IO_SOCKET_SSL(IO::Socket::SSL::errstr()) which is also returned in the 0.8.22 code but somehow doesn't make it to STDOUT. This would give a message like "error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed" which helps a lot if used in Google.
Until this issue is fixed and if someone finds this report having the same problem, here is my temporary fix:
use Mozilla::CA;
IO::Socket::SSL::set_defaults(
SSL_ca_file => Mozilla::CA::SSL_ca_file(),
);
-Michael