diff options
author | intrigeri <intrigeri@boum.org> | 2008-11-02 13:11:00 +0100 |
---|---|---|
committer | intrigeri <intrigeri@boum.org> | 2008-11-02 13:11:00 +0100 |
commit | 77136538788350ad2decaa445704ba5738074736 (patch) | |
tree | acb6ea4f00bb43e78a829b1d84a42384c7f37f50 /doc/bugs/ssl_certificates_not_checked_with_openid.mdwn | |
parent | fadb26bc1507f7fc2caaa873ad32c12f75c378aa (diff) | |
parent | c2684b94b27c12b5e39bfbb026163b62842a9908 (diff) |
Merge commit 'origin/master' into prv/po
Diffstat (limited to 'doc/bugs/ssl_certificates_not_checked_with_openid.mdwn')
-rw-r--r-- | doc/bugs/ssl_certificates_not_checked_with_openid.mdwn | 19 |
1 files changed, 18 insertions, 1 deletions
diff --git a/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn b/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn index 2dc74a984..04ece0ae8 100644 --- a/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn +++ b/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn @@ -65,4 +65,21 @@ significantly harder than the network based attacks." With regards to implementation, I am surprised that the libraries don't seem to do this checking, already, and by default. Unfortunately, I am not sure how to test -this adequately, see <http://bugs.debian.org/466055>. -- Brian May +this adequately, see [[!debbug 466055]]. -- Brian May + +--- + +I think [[!cpan Crypt::SSLeay]] already supports checking the certificate. The trick +is to get [[!cpan LWP::UserAgent]], which is used by [[!cpan LWPx::ParanoidAgent]] to +enable this checking. + +I think the trick is to set one of the the following environment variables before retrieving +the data: + +$ENV{HTTPS\_CA\_DIR} = "/etc/ssl/certs/"; +$ENV{HTTPS\_CA\_FILE} = "/etc/ssl/certs/file.pem"; + +Unfortunately I get weird results if the certificate verification fails, see [[!debbug 503440]]. +It still seems to work though, regardless. + +-- Brian May |