Package: libwww-perl
Version: 6.08-1
When keep-alive is enabled then second (and subsequent) requests to the
same HTTPS host causes "Client-SSL-Warning: Peer certificate not
verified" headers in the response headers. Hopefully this is false
positive: since the requests reused the existing connection, there was
nothing to check.
To reproduce, run the attached test script:
$ perl test_keepalive_https.pl
Client-SSL-Warning: (none)
Client-SSL-Warning: Peer certificate not verified
Client-SSL-Warning: Peer certificate not verified
-- System Information:
Debian Release: 8.0
APT prefers unstable
APT policy: (990, 'unstable'), (500, 'experimental')
Architecture: i386 (x86_64)
Foreign Architectures: amd64
Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores)
Locale: LANG=C, LC_CTYPE=pl_PL.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)
Versions of packages libwww-perl depends on:
ii ca-certificates 20141019
ii libencode-locale-perl 1.03-1
ii libfile-listing-perl 6.04-1
ii libhtml-parser-perl 3.71-1+b3
ii libhtml-tagset-perl 3.20-2
ii libhtml-tree-perl 5.03-1
ii libhttp-cookies-perl 6.01-1
ii libhttp-date-perl 6.02-1
ii libhttp-message-perl 6.06-1
ii libhttp-negotiate-perl 6.00-2
ii liblwp-mediatypes-perl 6.02-1
ii liblwp-protocol-https-perl 6.06-2
ii libnet-http-perl 6.07-1
ii liburi-perl 1.64-1
ii libwww-robotrules-perl 6.01-1
ii netbase 5.3
ii perl 5.20.1-4
--
Jakub Wilk
#!/usr/bin/perl
use strict;
use warnings;
use LWP::UserAgent;
my $ua = LWP::UserAgent->new(keep_alive => 1);
for my $i (1..3) {
my $response = $ua->head('https://www.example.com/');
print 'Client-SSL-Warning: ' . ($response->header('Client-SSL-Warning') // '(none)') . "\n";
}
