LWP v6.00 & Self-signed Certificates.
If you're an existing CPAN Tester, and have recently upgraded LWP, you may have noticed that your report submissions have been failing. The reason being that LWP::UserAgent now requires that any https protocol request, needs to verify the certificate associated with it. With the Metabase having a self-signed certificate, this doesn't provide enough verification and so fails.
In the short term if you don't need to update LWP (libwww-perl), refrain from doing so for the time being. For those that have already done so, or have recently built test machines from a clean starting point, you will either need to wait until we have put a long term solution in place, or may wish to look at a solution from Douglas Wilson. Douglas has created a "hypothetical distribution", which you can see via a gist.
Others have also blogged about the problem, and have suggests and insights as to how to overcome this for the short term:
- CPAN::Reporter, Transport::Metabase, and libwww-lwp 6 by Douglas Wilson
- CPAN::Reporter fails to send through Metabase with new LWP 6 by Randy Stauner
- SSL host checking and LWP::UserAgent by Colin Newell
We will have more details of the longer term solution soon.
Cross-posted from the CPAN Testers Blog
This is the new account for incidental and summary updates to what's happening with the CPAN Testers. For all the latest news and views please see our blog.
Leave a comment