title: How can I get LWP to validate SSL server certificates?
body: <p>How can I get <a href="http://search.cpan.org/perldoc?LWP" rel="noreferrer">LWP</a> to verify that the certificate of the server I'm connecting to is signed by a trusted authority and issued to the correct host?  As far as I can tell, it doesn't even check that the certificate claims to be for the hostname I'm connecting to.  That seems like a major security hole (especially with the recent DNS vulnerabilities).</p>
  
  <p><strong>Update:</strong>  It turns out what I really wanted was <code>HTTPS_CA_DIR</code>, because I don't have a ca-bundle.crt.  But <code>HTTPS_CA_DIR=/usr/share/ca-certificates/</code> did the trick.  I'm marking the answer as accepted anyway, because it was close enough.</p>
  
  <p><strong>Update 2:</strong> It turns out that <code>HTTPS_CA_DIR</code> and <code>HTTPS_CA_FILE</code> only apply if you're using Net::SSL as the underlying SSL library.  But LWP also works with IO::Socket::SSL, which will ignore those environment variables and happily talk to any server, no matter what certificate it presents.  Is there a more general solution?</p>
  
  <p><strong>Update 3:</strong> Unfortunately, the solution still isn't complete.  Neither Net::SSL nor IO::Socket::SSL is checking the host name against the certificate.  This means that someone can get a legitimate certificate for some domain, and then impersonate any other domain without LWP complaining.</p>
  
  <p><strong>Update 4:</strong> <a href="http://search.cpan.org/dist/libwww-perl/" rel="noreferrer">LWP 6.00</a> finally solves the problem.  See <a href="https://stackoverflow.com/questions/74358/how-can-i-get-lwp-to-validate-ssl-server-certificates#5329129">my answer</a> for details.</p>