Merge commit 'origin/master' into pub/master

[git.ikiwiki.info.git] / doc / bugs / ssl_certificates_not_checked_with_openid.mdwn

diff --git a/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn b/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn
index e976ed5bd0225ddedf90358a1dbe7504d4df27fa..04ece0ae84ee1c2a9df0c6db597703bde5213c3e 100644 (file)
--- a/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn
+++ b/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn
@@ -40,7 +40,7 @@ For now, I want to try and resolve the issues with net\_ssl\_test, and run more
 >> -- Brian May
 
 >>> I guess that the place to add SSL cert checking would be in either
->>> [[cpan LWPx::ParanoidAgent]] or [[cpan Net::OpenID::Consumer]]. Adding
+>>> [[!cpan LWPx::ParanoidAgent]] or [[!cpan Net::OpenID::Consumer]]. Adding
 >>> it to ikiwiki itself, which is just a user of those libraries, doesn't
 >>> seem right.
 >>> 
@@ -65,4 +65,21 @@ significantly harder than the network based attacks."
 
 With regards to implementation, I am surprised that the libraries don't seem to
 do this checking, already, and by default. Unfortunately, I am not sure how to test
-this adequately, see <http://bugs.debian.org/466055>. -- Brian May
+this adequately, see [[!debbug 466055]]. -- Brian May
+
+--- 
+
+I think [[!cpan Crypt::SSLeay]] already supports checking the certificate. The trick
+is to get [[!cpan LWP::UserAgent]], which is used by [[!cpan LWPx::ParanoidAgent]] to
+enable this checking.
+
+I think the trick is to set one of the the following environment variables before retrieving
+the data:
+
+$ENV{HTTPS\_CA\_DIR} = "/etc/ssl/certs/";  
+$ENV{HTTPS\_CA\_FILE} = "/etc/ssl/certs/file.pem";  
+
+Unfortunately I get weird results if the certificate verification fails, see [[!debbug 503440]].
+It still seems to work though, regardless.
+
+-- Brian May