CODEWITHSUNDEEP
perlvalidationsslssl-certificate
Arvind
Arvind

Reputation: 1

Trying to get SSL certificate errors

Hi I am trying to get SSL certificates from a perl script. The primary purpose is to check for SSL certificates that are untrusted as given described here. However I am unsure as to how to proceed. I do not have a certificate authority that i can check the certificate with and hence even urls with valid certificates sem to throw errors. The following is the code I wrote 

#!/usr/bin/perl

require LWP::UserAgent;
use Crypt::SSLeay::CTX;
use Crypt::SSLeay::Conn;
use Crypt::SSLeay::X509;
use LWP::Simple qw(get);

$ENV{HTTPS_DEBUG} = 1;


my $ua  = LWP::UserAgent->new;
#$ua->ssl_opts(verify_hostname => "true");
$ua->timeout(300);
my $req = HTTP::Request->new(GET => 'https://abcdefxyz.com');

my $res = $ua->request($req);

print $res->headers_as_string . "\n" . $res->status_line;

I ran it this way

perl test2.pm >test

SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
SSL_connect:SSLv3 read server hello A
SSL_connect:SSLv3 read server certificate A
SSL_connect:SSLv3 read server key exchange A
SSL_connect:SSLv3 read server done A
SSL_connect:SSLv3 write client key exchange A
SSL_connect:SSLv3 write change cipher spec A
SSL_connect:SSLv3 write finished A
SSL_connect:SSLv3 flush data
SSL_connect:SSLv3 read finished A

And here is the output for the same.

Connection: close
Date: Tue, 29 Mar 2011 01:56:44 GMT
Server: Server
Vary: Accept-Encoding,User-Agent
WWW-Authenticate: Negotiate
WWW-Authenticate: Basic realm="abc (Windows) Login"
Content-Length: 401
Content-Type: text/html; charset=iso-8859-1
Client-Date: Tue, 29 Mar 2011 01:56:44 GMT
Client-Peer: 127.0.0.1:5443
Client-Response-Num: 1
Client-SSL-Cert-Issuer: /C=US/ST=Illinois/L=Chicago/O=abcdefxyz.com /CN=abcdefxyz.com
Client-SSL-Cert-Subject: /C=US/ST=Illinois/L=Chicago/O=abcdefxyz.com /CN=abcdefxyz.com
Client-SSL-Cipher: DHE-RSA-AES256-SHA
Client-SSL-Warning: Peer certificate not verified
Client-Warning: Unsupported authentication scheme 'negotiate'
Title: 401 Authorization Required
X-Pad: avoid browser bug

401 Authorization Required

Is there anyway for me to get the SSL error type of the certificate without having a local CA file. I am a newbie here and to perl, so helpful insights would be greatly appreciated.

Upvotes: 0

Views: 2600

Answers (1)

daxim
daxim

Reputation: 39158

Upgrade to the most recent version of LWP::Protocol::https. This will automatically pull in the appropriate dependencies, e.g. a recent IO::Socket::SSL and Mozilla::CA. LWP v6 introduced automatic verification of CA signatures.

You can make your own certificates, both valid, valid with CA signature and all sorts of invalid. See How do I create a real SSL Certificate? in the Apache httpd documentation, Creating your own CA with OpenSSL (slightly out-of-date) and the rsa and CA.pl manpages in the OpenSSL documentation.

Upvotes: 1

Related Questions