By default COMM:ATTACH-SSL doesn't doesn't do certificate verification, there needs to be an extra step to configure the SSL object, which is what this pull request does. Tests are passing now (it was failing earlier)
Communication from Martin Simmons from Lispworks when I checked this with him:
Hi Arnold,
LispWorks doesn't verify the certificate by default. You need to use
comm:set-verification-mode to make it do this (see the example below).
Note that it can also be used inside the configuration callbacks that
can be passed to comm::open-tcp-stream, and also can be used on each
comm:ssl-pointer rather than on the comm:ssl-ctx-pointer.
The point of using the callbacks is to avoid the need to explicitly
create the ssl-ctx before calling comm:open-tcp-stream.
-------------------------------
(defvar *my-verifying-ctx* nil)
;;; initialize-verifying-ctx is assumed to be called once at run time during
;;; initialization of the application.
(defun initialize-verifying-ctx ()
(let ((ctx (comm:make-ssl-ctx ::ssl-side :client)))
(comm:set-verification-mode ctx :client :always nil)
;; ... other configuration
(setq *my-verifying-ctx* ctx)))
---------------------------
CL-USER 3 > (initialize-verifying-ctx)
#<SSL-CTX-POINTER = #x100223DF0 {CLIENT}>
CL-USER 4 > (comm:open-tcp-stream "google.com" 443 :ssl-ctx *my-verifying-ctx*)
#<COMM:SOCKET-STREAM 402001C02B>
CL-USER 5 > (comm:open-tcp-stream "self-signed.badssl.com" 443 :ssl-ctx *my-verifying-ctx*)
Error: SSL failure in #<COMM:SOCKET-STREAM 402001EEFB>: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
1 (abort) Return to level 0.
2 Restart top-level loop.
Type :b for backtrace or :c <option number> to proceed.
Type :bug-form "<subject>" for a bug report template or :? for other options.
By default COMM:ATTACH-SSL doesn't doesn't do certificate verification, there needs to be an extra step to configure the SSL object, which is what this pull request does. Tests are passing now (it was failing earlier)
Communication from Martin Simmons from Lispworks when I checked this with him: