LWP v6.00 & Self-signed Certificates.
If you're an existing CPAN Tester, and have recently upgraded LWP, you may have noticed that your report submissions have been failing. The reason being that LWP::UserAgent now requires that any https protocol request, needs to verify the certificate associated with it. With the Metabase having a self-signed certificate, this doesn't provide enough verification and so fails.
In the short term if you don't need to update LWP (libwww-perl), refrain from doing so for the time being. For those that have already done so, or have recently built test machines from a clean starting point, you will either need to wait until we have put a long term solution in place, or may wish to look at a solution from Douglas Wilson. Douglas has created a "hypothetical distribution", which you can see via a gist.
Others have also blogged about the problem, and have suggests and insights as to how to overcome this for the short term:
- CPAN::Reporter, Transport::Metabase, and libwww-lwp 6 by Douglas Wilson
- CPAN::Reporter fails to send through Metabase with new LWP 6 by Randy Stauner
- SSL host checking and LWP::UserAgent by Colin Newell
We will have more details of the longer term solution soon.
Cross-posted from the CPAN Testers Blog
Leave a comment