Thread [LWP] validiert Zertifikat nicht (Strawberry Win32) (10 answers)
Opened by GwenDragon at 2014-04-14 14:34

GwenDragon
 2014-04-14 14:34
#174748 #174748
User since
2005-01-17
14760 Artikel
Admin1
[Homepage]
user image
Seltsamerweise überprüft LWP nur bei Strawberry Perl 5.12.3 (Windows 32bit) die Root-Zertifikate in ca-certificates.crt (CA-Datei als PEM).
Bei 5.14 und später klappts nicht.

Code (perl): (dl )
1
2
3
4
5
6
7
8
9
10
11
12

use LWP::UserAgent; 
use strict;
use warnings;

$ENV{HTTPS_DEBUG} = 1;
$ENV{HTTPS_CA_FILE} = 'X:/etc/ssl/certs/ca-certificates.crt';
$ENV{HTTPS_CA_PATH} = 'X:/etc/ssl/certs/';

my $ua  = LWP::UserAgent->new; 
my $req = HTTP::Request->new(GET => 'https://www.bsi.bund.de');
my $res = $ua->request($req);
print $res->headers_as_string;

ergibt:
Code: (dl )
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
Cache-Control: max-age=60
Connection: close
Date: Mon, 14 Apr 2014 12:27:11 GMT
Server: HTTP/1.1
Vary: Accept-Encoding
Content-Language: de
Content-Length: 26248
Content-Type: text/html;charset=utf-8
Expires: Mon, 14 Apr 2014 12:19:39 GMT
Last-Modified: Mon, 14 Apr 2014 12:18:39 GMT
Client-Date: Mon, 14 Apr 2014 12:27:12 GMT
Client-Peer: 77.87.229.76:443
Client-Response-Num: 1
Client-SSL-Cert-Issuer: /C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Class 2 L1 CA/CN=TC TrustCenter Class 2 L1 CA XI
Client-SSL-Cert-Subject: /C=DE/ST=NRW/L=Koeln/O=Bundesverwaltungsamt/OU=BIT B 5/CN=www.bsi.bund.de
Client-SSL-Cipher: DHE-RSA-AES256-SHA
Content-Base: https://www.bsi.bund.de/
Content-Style-Type: text/css
Imagetoolbar: false
Link: <DE/Home/home_node.html#Start>; rel="bookmark"; title="Zum Inhalt"; type="text/html"
Link: <DE/Service/Impressum/impressum_node.html>; rel="copyright"; title="Impressum"; type="text/html"
Link: <DE/Home/home_node.html>; rel="start"; title="Homepage"; type="text/html"
Link: <DE/Service/Sitemap/sitemap_node.html>; rel="contents"; title=""; type="text/html"
Link: <DE/Service/Suche/suche_node.html>; rel="search"; title="Suche"; type="text/html"
Link: <DE/DasBSI/dasbsi_node.html>; rel="chapter"; title="Das BSI"; type="text/html"
Link: <DE/Themen/themen_node.html>; rel="chapter"; title="Themen"; type="text/html"
Link: <DE/Aktuelles/aktuelles_node.html>; rel="chapter"; title="Aktuelles"; type="text/html"
Link: <DE/Presse/presse_node.html>; rel="chapter"; title="Presse"; type="text/html"
Link: <DE/Publikationen/publikationen_node.html>; rel="chapter"; title="Publikationen"; type="text/html"
Link: <DE/Home/hidden_node.html>; rel="chapter"; title="Homepage"; type="text/html"
Link: </SiteGlobals/StyleBundles/Bilder/favicon.ico?__blob=normal&v=2>; rel="shortcut icon"; type="image/ico"
Link: <SiteGlobals/Functions/RSSFeed/RSSNewsfeed/RSSNewsfeed.xml>; rel="alternate"; title="BSI RSS-Newsfeed Presse- und Kurzmitteilungen"; type="application/rss+xml"
Link: <SiteGlobals/StyleBundles/CSS/visual/visual.css?v=2>; media="print, projection, screen"; rel="stylesheet"; type="text/css"
Link: <SiteGlobals/StyleBundles/CSS/screen/screen-a.css?v=3>; media="projection, screen"; rel="stylesheet"; type="text/css"
Link: <SiteGlobals/StyleBundles/CSS/print/print.css?v=2>; media="print"; rel="stylesheet"; type="text/css"
Set-Cookie: server-id=1294; path=/
Title: BSI: Startseite Bundesamt f├╝r Sicherheit in der Informationstechnik
X-Frame-Options: sameorigin
X-Meta-Description: Startseite Bundesamt f├╝r Sicherheit in der Informationstechnik. Hier erhalten Sie aktuelle Informationen zu Themen rund um die IT-Sicherheit.
X-Meta-Generator: Government Site Builder 4.0
X-Meta-GenTime: Mon Apr 14 14:18:39 CEST 2014
X-Meta-Keywords: BSI, Bundesamt, Informationstechnologie, Informationstechnik, CERT-Bund, CERT, Sicherheitsberatung, IT-Sicherheit
X-Meta-MSSmartTagsPreventParsing: true
X-Server-Generated: Mon, 14 Apr 2014 12:18:39 GMT
X-Server-Instance-Name: 2_cid294
X-XSS-Protection: 1; mode=block
SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
SSL_connect:SSLv3 read server hello A
SSL_connect:SSLv3 read server certificate A
SSL_connect:SSLv3 read server key exchange A
SSL_connect:SSLv3 read server done A
SSL_connect:SSLv3 write client key exchange A
SSL_connect:SSLv3 write change cipher spec A
SSL_connect:SSLv3 write finished A
SSL_connect:SSLv3 flush data
SSL_connect:SSLv3 read finished A
SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
SSL_connect:SSLv3 read server hello A
SSL_connect:SSLv3 read server certificate A
SSL_connect:SSLv3 read server key exchange A
SSL_connect:SSLv3 read server done A
SSL_connect:SSLv3 write client key exchange A
SSL_connect:SSLv3 write change cipher spec A
SSL_connect:SSLv3 write finished A
SSL_connect:SSLv3 flush data
SSL_connect:SSLv3 read finished A


während 5.14 ff folgendes zeigt (beachte das Client-SSL-Warning: Peer certificate not verified):
Code: (dl )
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
Cache-Control: max-age=60
Connection: close
Date: Mon, 14 Apr 2014 12:28:31 GMT
Server: HTTP/1.1
Vary: Accept-Encoding
Content-Language: de
Content-Length: 26248
Content-Type: text/html;charset=utf-8
Expires: Mon, 14 Apr 2014 12:27:36 GMT
Last-Modified: Mon, 14 Apr 2014 12:26:36 GMT
Client-Date: Mon, 14 Apr 2014 12:28:31 GMT
Client-Peer: 77.87.229.76:443
Client-Response-Num: 1
Client-SSL-Cert-Issuer: /C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Class 2 L1 CA/CN=TC TrustCenter Class 2 L1 CA XI
Client-SSL-Cert-Subject: /C=DE/ST=NRW/L=Koeln/O=Bundesverwaltungsamt/OU=BIT B 5/CN=www.bsi.bund.de
Client-SSL-Cipher: ECDHE-RSA-AES256-SHA
Client-SSL-Socket-Class: IO::Socket::SSL
Client-SSL-Warning: Peer certificate not verified
Content-Base: https://www.bsi.bund.de/
Content-Style-Type: text/css
Imagetoolbar: false
Link: <DE/Home/home_node.html#Start>; rel="bookmark"; title="Zum Inhalt"; type="text/html"
Link: <DE/Service/Impressum/impressum_node.html>; rel="copyright"; title="Impressum"; type="text/html"
Link: <DE/Home/home_node.html>; rel="start"; title="Homepage"; type="text/html"
Link: <DE/Service/Sitemap/sitemap_node.html>; rel="contents"; title=""; type="text/html"
Link: <DE/Service/Suche/suche_node.html>; rel="search"; title="Suche"; type="text/html"
Link: <DE/DasBSI/dasbsi_node.html>; rel="chapter"; title="Das BSI"; type="text/html"
Link: <DE/Themen/themen_node.html>; rel="chapter"; title="Themen"; type="text/html"
Link: <DE/Aktuelles/aktuelles_node.html>; rel="chapter"; title="Aktuelles"; type="text/html"
Link: <DE/Presse/presse_node.html>; rel="chapter"; title="Presse"; type="text/html"
Link: <DE/Publikationen/publikationen_node.html>; rel="chapter"; title="Publikationen"; type="text/html"
Link: <DE/Home/hidden_node.html>; rel="chapter"; title="Homepage"; type="text/html"
Link: </SiteGlobals/StyleBundles/Bilder/favicon.ico?__blob=normal&v=2>; rel="shortcut icon"; type="image/ico"
Link: <SiteGlobals/Functions/RSSFeed/RSSNewsfeed/RSSNewsfeed.xml>; rel="alternate"; title="BSI RSS-Newsfeed Presse- und Kurzmitteilungen"; type="application/rss+xml"
Link: <SiteGlobals/StyleBundles/CSS/visual/visual.css?v=2>; media="print, projection, screen"; rel="stylesheet"; type="text/css"
Link: <SiteGlobals/StyleBundles/CSS/screen/screen-a.css?v=3>; media="projection, screen"; rel="stylesheet"; type="text/css"
Link: <SiteGlobals/StyleBundles/CSS/print/print.css?v=2>; media="print"; rel="stylesheet"; type="text/css"
Set-Cookie: server-id=1359; path=/
Title: BSI: Startseite Bundesamt f├╝r Sicherheit in der Informationstechnik
X-Frame-Options: sameorigin
X-Meta-Description: Startseite Bundesamt f├╝r Sicherheit in der Informationstechnik. Hier erhalten Sie aktuelle Informationen zu Themen rund um die IT-Sicherheit.
X-Meta-Generator: Government Site Builder 4.0
X-Meta-GenTime: Mon Apr 14 14:26:36 CEST 2014
X-Meta-Keywords: BSI, Bundesamt, Informationstechnologie, Informationstechnik, CERT-Bund, CERT, Sicherheitsberatung, IT-Sicherheit
X-Meta-MSSmartTagsPreventParsing: true
X-Server-Generated: Mon, 14 Apr 2014 12:26:36 GMT
X-Server-Instance-Name: 2_cid359
X-XSS-Protection: 1; mode=block


Openssl ist laut C:\strawberry\c\bin\openssl.exe version:
Perl 5.12: OpenSSL 0.9.8l 5 Nov 2009
Perl 5.14: OpenSSL 1.0.1e 11 Feb 2013
Perl 5.16: OpenSSL 1.0.1e 11 Feb 2013
Perl 5.18: OpenSSL 1.0.1e 11 Feb 2013
Last edited: 2014-04-14 14:49:09 +0200 (CEST)
die Drachin Gwen

Meine Perl-Artikel · perldev – verschiedene Perl-Versionen unter Windows starten

View full thread [LWP] validiert Zertifikat nicht (Strawberry Win32)