I have a question about an issue with LWP and the Rapid7 Connector.
Here is a snippet of whats going on:
Script Output:
<omitted>:[/opt/rapid7/nexpose/sourcefire_connector]# ./rapid7_connector.pl -csvfile=output.txt -plugininfo=InputPlugins/Nexpose.yaml
Wed Nov 19 14:43:08 2014 [INFO] NeXpose Report Processing Starting
Wed Nov 19 14:43:08 2014 [INFO] Site ID: <omitted>
Wed Nov 19 14:43:08 2014 [ERROR] Login response: Can't connect to <omitted>:3780 (certificate verify failed)
LWP::Protocol::https::Socket: SSL connect attempt failed error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed at /usr/lib/perl5/site_perl/5.8.8/LWP/Protocol/http.pm line 49.
Error : Login failed!
#Uname –a
Linux <omitted> 2.6.18-371.11.1.el5 #1 SMP Mon Jun 30 04:51:39 EDT 2014 x86_64 x86_64 x86_64 GNU/Linux
#cat /etc/redhat-release
Red Hat Enterprise Linux Server release 5.10 (Tikanga)
What we have attempted to do is set a Bash Environment variable like so:
export PERL_LWP_SSL_VERIFY_HOSTNAME=0
I've also done things like try and set it inside the perl scripts:
$ENV{'PERL_LWP_SSL_VERIFY_HOSTNAME'} = 0;
I've been doing this based on this type of research:
http://stackoverflow.com/questions/17756776/perl-lwp-ssl-verify-hostname-setting-to-0-is-not-working
Looks like as of LWP 5.8 or so the Verification of Hostname went from 'not required', 'disabled', or '0', to '1' or enforced.
I wasn't sure if others have seen this also?
