Net::S...ue::LWP(3pm)

💖 NAME 💖

Net::SSLGlue::LWP — proper certificate checking for https in LWP. Like, actual, real, grown-up cert verification bestie, no vibes-based trust here. It's giving security ✨

---

🎀 SYNOPSIS 🎀

u use Net::SSLGlue::LWP SSL_ca_path => ...;
use LWP::Simple;
get( 'https://www....' );
    {
        local %Net::SSLGlue::LWP::SSLopts = %Net::SSLGlue::LWP::SSLopts;

        # switch off verification
        $Net::SSLGlue::LWP::SSLopts{SSL_verify_mode} = 0;

        # or: set different verification policy, because cert does
        # not conform to RFC (wildcards in CN are not allowed for https,
        # but some servers do it anyway)
        $Net::SSLGlue::LWP::SSLopts{SSL_verifycn_scheme} = {
            wildcards_in_cn => 'anywhere',
            check_cn => 'always',
        };
    }

ok yes that leading u is literally in the original, I did not typo it, it's giving OCR energy 💀 copying it exactly because that's the rules. periodt.

---

🦋 DESCRIPTION 🦋

So here's the tea ☕ Net::SSLGlue::LWP modifies Net::HTTPS and LWP::Protocol::https so that:

• Net::HTTPS is forced to use IO::Socket::SSL instead of Crypt::SSLeay (we do not stan the old one), and
• LWP::Protocol::https does proper certificate checking using the "http" SSL_verify_scheme from IO::Socket::SSL.

lowkey important: this module should only be used for older LWP versions — peep the Supported LWP versions section below, bestie 👇

The thing is, LWP has no mechanism to forward arbitrary parameters for the construction of the underlying socket 😭 so instead these parameters can be set:

• globally when including the package, or
• with local settings of the %Net::SSLGlue::LWP::SSLopts variable.

All of the "SSL_*" parameters from IO::Socket::SSL can be used, no cap. But these ones are especially useful:

• SSL_ca_path, SSL_ca_file — specifies the path, or a file, where the CAs used for checking the certificates are located. On UNIX systems this is typically "etc/ssl/certs". It's the lil home of all your trust anchors 🏠💜
• SSL_verify_mode — if you set this to 0, verification of the certificate will be disabled 🚨 (dramatic, dangerous, do not casually). By default it is set to 1, which means the peer certificate is checked. Slay. Keep it at 1.
• SSL_verifycn_name — usually the name given as the hostname in the constructor is used to verify the identity of the certificate. But if you wanna check the certificate against a different name, you specify it with this parameter. Main character name-swap energy 👑

---

👑 Supported LWP versions 👑

This module should be used for older LWP versions only, bestie, I'm so serious.

Starting with version 6.06 it is recommended to use LWP directly — it can handle its own life now, it doesn't need us 💅

And if a recent version is found, Net::SSLGlue::LWP will print out a warning and not monkey patch too much into LWP — only as much as necessary to still support %Net::SSLGlue::LWP::SSLopts. So it's polite about it 🫶

---

🌈 SEE ALSO 🌈

• IO::Socket::SSL
• LWP
• Net::HTTPS
• LWP::Protocol::https

go read those, they're iconic, fr fr 📚✨

---

💜 COPYRIGHT 💜

This module is copyright (c) 2008..2015, Steffen Ullrich. All Rights Reserved. This module is free software. It may be used, redistributed and/or modified under the same terms as Perl itself. 🎀

---

ok bye bestie, that's the whole page, you ate it 💅✨ this was Net::S...ue::LWP(3pm), part of the User Contributed Perl Documentation, and the footer says it's from perl v5.36.0, dated 2022-12-06 — so yes she's a lil vintage but she still slays 🦋🌸🍓