| Subject: | AnyEvent::TLS failing to verify certs IO::Socket::SSL and FireFox can verify. |
When using
tls_ctx => {
verify => 1,
verify_peername => 'http',
ca_file => Mozilla::CA::SSL_ca_file(),
},
AnyEvent fails to connect to rpc.blockchain.info with the error
ssl3_get_server_certificate: certificate verify failed
IO::Socket::SSL has no problem connection with the same settings:
SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_PEER, # 1
SSL_verifycn_scheme => 'http',
SSL_ca_file => Mozilla::CA::SSL_ca_file(),
I narrowed the problem to a difference in the values returned by Net::SSLeay::X509_get_subjectAltNames.
For AnyEvent::TLS, Net::SSLeay::X509_get_subjectAltNames($cert) returns
0 2
1 'blockchain.info'
2 2
3 'www.blockchain.info'
For IO::Socket::SSL, Net::SSLeay::X509_get_subjectAltNames($cert) returns
0 2
1 '*.blockchain.info'
2 2
3 'blockchain.info'
I have no idea how to determine why the returned values are different.
- Eric "ikegami" Brine
| Subject: | c.pl |
use strict;
use warnings;
use feature qw( say );
use AnyEvent qw( );
use AnyEvent::Handle qw( );
use Data::Dumper qw( Dumper );
use IO::Socket::SSL qw( );
use Mozilla::CA qw( );
sub Dump {
local $Data::Dumper::Useqq = 1;
local $Data::Dumper::Terse = 1;
local $Data::Dumper::Indent = 0;
return Dumper($_[0]);
}
# ---
my $done = AnyEvent->condvar();
my $handle = AnyEvent::Handle->new(
connect => [ 'rpc.blockchain.info', 'https' ],
tls => 'connect',
tls_ctx => {
verify => 1,
verify_peername => 'http',
ca_file => Mozilla::CA::SSL_ca_file(),
},
on_eof => sub {
my $self = shift;
say "AnyEvent::TLS: ok";
$self->destroy;
$done->send;
},
on_error => sub {
my $self = shift;
say "AnyEvent::TLS: ", Dump(\@_);
$self->destroy;
$done->send;
},
);
$handle->push_write("GET / HTTP/1.0\r\n\r\n");
$done->recv();
# ---
my $sock = IO::Socket::SSL->new(
PeerHost => 'rpc.blockchain.info',
PeerPort => 'https',
SSL_verify_mode => 1, # IO::Socket::SSL::SSL_VERIFY_PEER
SSL_verifycn_scheme => 'http',
SSL_ca_file => Mozilla::CA::SSL_ca_file(),
);
say "IO::Socket::SSL: ", $sock ? "ok" : "Failed connect or ssl handshake: $!,$IO::Socket::SSL::SSL_ERROR";