command line ssl_verifypeer false

[fvanderbiest]

I'm currently proofing my jekyll-generated site with htmlproof ./_site and I'd like to get rid of those warnings:

External link failed: 302 Peer certificate cannot be authenticated with given CA certificates
External link  failed: 0 SSL connect error
External link  failed: 302 SSL connect error

I could not find any documentation on how to disable ssl_verifypeer using the htmlproof binary.

[doktorbro]

The usage of the option ssl_verifypeer is a mystery. See #141.

[doktorbro]

Can you try to curl your link and show us the output?

curl --url https://www.example.com/ --verbose

[fvanderbiest]

Sure.

$ curl --url https://sdi.georchestra.org/ci/ --verbose
* Hostname was NOT found in DNS cache
*   Trying 195.154.179.143...
* Connected to sdi.georchestra.org (195.154.179.143) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using ECDHE-RSA-AES256-GCM-SHA384
* Server certificate:
*    subject: C=FR; CN=sdi.georchestra.org; emailAddress=webmaster@georchestra.org
*    start date: 2014-12-30 15:31:45 GMT
*    expire date: 2015-12-31 19:14:52 GMT
*    subjectAltName: sdi.georchestra.org matched
*    issuer: C=IL; O=StartCom Ltd.; OU=Secure Digital Certificate Signing; CN=StartCom Class 1 Primary Intermediate Server CA
*    SSL certificate verify ok.

An other one

$ curl --url https://gitlab.geo.gob.bo/adsib/georchestra_ansible/tree/master --verbose
* Hostname was NOT found in DNS cache
*   Trying 200.87.148.69...
* Connected to gitlab.geo.gob.bo (200.87.148.69) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS alert, Server hello (2):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

[sroberts]

I'm also running into some similar errors, though only in CI (Circle & Travis both). It cleanly on my system though. Using the --only-4xx option works, but obviously I don't like missing all those checks.

[gjtorikian]

@sroberts Out of curiosity is your CI configured to run on Ubuntu 14.10? (I think Travis has a beta option for configuring this now.)

I ask because previously it looks like OS X and 12.04 are fine with the config, but 14.10 changed something. Just want to make sure this is not actually a 12.04 problem too.

[doktorbro]

From what I see the binary ignores Typhoeus options. I think #175 could be the solution for an easygoing command line usage.

[sroberts]

@gjtorikian According to CircleCIs documentation, and I don't think I'm doing anything special with it, this should be a 12.04 VM.

[akshayrawat]

Any updates on this? I'm seeing the same behavior on OSX (no error) and CircleCI (error).

[akshayrawat]

For now I've fixed it for CircleCI by specifying sudo apt-get install libcurl3-dev as a prerequisite dependency.

[SeanKilleen]

If you're looking to set ssl_verifypeer as a typhoeus option, #490 was just merged which I think should allow this from the command line once the next gem release is published.

The syntax would be along the lines of ruby htmlproofer --typhoeus-config '{ "ssl_verifypeer": false }' [directory I'm testing]

[gjtorikian]

Seems a solution for this was already implemented!