-
Notifications
You must be signed in to change notification settings - Fork 52
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
HTTP-Tiny-0.084: After upgrade from v0.083, cpan command fails on Strawberry Perl 5.16.3 #155
Comments
When I run the attached script as a test, HTTP::Tiny->new->get('https://github.com/') succeeds, but HTTP::Tiny->new->get('https://cpan.org/') fails.
|
The variable is documented as
|
Can you include the output of $Mozilla::CA::VERSION as well? Since your tests fail on cpan.org but work on github.com I'm speculating that it is due to https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/ |
@stigtsp Output:
|
This is recent and should work for validating cpan.org, i.e. not disabling certificate validation should be needed. Please run your code with |
@noxxi
|
Looks like you run into the issue with certificate validation when cross-signing is used: cpan.org sends the following trust chain:
The "ISRG Root X1" given as intermediate CA is contained in Mozilla::CA but "DST Root CA X3" as expected root CA is not since it is obsolete for several years now. A proper TLS stack will detect this and stop chain validation at the first CA certificate in the chain which can be backed by the local trust store. The old version of OpenSSL (OpenSSL 1.0.1e) which comes with your old version of Strawberry Perl (released 10 years ago!!!) instead insists on validating the final CA certificate from the server provided chain with the local trust store - which fails. To provide proper validation while keeping your old distribution you need to explicitly add the missing "DST Root CA X3" to your trust store. It could be downloaded from here. But I really recommend to upgrade your Perl - the OpenSSL version is really old and also does not support modern TLS 1.3. |
After upgrading from version 0.084 to 0.086, I have just been able to confirm that the value of the environment variable
Thanks everyone! |
Hello,
After I upgraded HTTP::Tiny from version 0.083 to 0.084, the cpan command fails even with the environment variable
PERL_HTTP_TINY_SSL_INSECURE_BY_DEFAULT
set to 1.I usually use cpan and cpanm.
I have cpan version is 2.34 and Mozilla::CA is up to date.
Under Strawberry Perl 5.16.3 (64 bit) on Windows 8.1 (64 bit):
Thank you,
The text was updated successfully, but these errors were encountered: