Problem/Motivation

https://curl.se/libcurl/c/libcurl-errors.html#CURLEPEERFAILEDVERIFICATION

Unhandled link error https://agewell-nce.ca/about-us has been found: : cURL error 60: SSL certificate problem: unable to get local issuer certificate (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://agewell-nce.ca/about-us.
Unhandled link error https://agewell-nce.ca/archives/8923 has been found: : cURL error 60: SSL certificate problem: unable to get local issuer certificate (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://agewell-nce.ca/archives/8923.
Unhandled link error https://cmd-f.nwplus.io has been found: : cURL error 3:
Unhandled link error https://modularity.info/ has been found: : cURL error 60: SSL: no alternative certificate subject name matches target host name 'modularity.info' (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://modularity.info/.
Unhandled link error https://modularity.info/conference/2015/ has been found: : cURL error 60: SSL: no alternative certificate subject name matches target host name 'modularity.info' (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://modularity.info/conference/2015/.
Unhandled link error https://quickbooks.intuit.com/ has been found.
Unhandled link error https://www.cdgdc.edu.cn/xwyyjsjyxx/aboutus/intro/277270.shtml has been found.
Unhandled link error https://www.chairs-chaires.gc.ca/ has been found: : cURL error 60: SSL certificate problem: unable to get local issuer certificate (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://www.chairs-chaires.gc.ca/.
Unhandled link error https://www.cs.bham.ac.uk/internal/modules/2012/06-23636/ has been found: : cURL error 60: SSL certificate problem: unable to get local issuer certificate (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://www.cs.bham.ac.uk/internal/modules/2012/06-23636/.
Unhandled link error https://www.cs.bham.ac.uk/internal/modules/2012/06-23899/ has been found: : cURL error 60: SSL certificate problem: unable to get local issuer certificate (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://www.cs.bham.ac.uk/internal/modules/2012/06-23899/.
Unhandled link error https://www.cs.bham.ac.uk/internal/modules/2016/06-02578/ has been found: : cURL error 60: SSL certificate problem: unable to get local issuer certificate (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://www.cs.bham.ac.uk/internal/modules/2016/06-02578/.
Unhandled link error https://www.cs.bham.ac.uk/internal/modules/2016/06-20008/ has been found: : cURL error 60: SSL certificate problem: unable to get local issuer certificate (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://www.cs.bham.ac.uk/internal/modules/2016/06-20008/.
Unhandled link error https://www.eluta.ca/ has been found.
Unhandled link error https://www.techinterview.org/ has been found: : cURL error 60: SSL certificate problem: certificate has expired (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://www.techinterview.org/.

Steps to reproduce

Proposed resolution

Find a way to conditionally or otherwise skip reporting the cert errors or ignore them.

Guzzle equivalent to

curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);

Remaining tasks

User interface changes

API changes

Data model changes

CommentFileSizeAuthor
#7 linkchecker-disable-ssl-verify-3402569-7.patch375 bytesidflood

Issue fork linkchecker-3402569

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

joelpittet created an issue. See original summary.

eiriksm’s picture

eiriksm
he/him
Primary language Norwegian Bokmål
Location Norway
commented

I think we already have an alter hook or event for changing the headers of the request. Maybe we can add one for guzzle options as well at least, as a first step?

joelpittet’s picture

joelpittet
he/him
Primary language English
Location Vancouver
commented

@eiriksm thanks for the reply.

Here's the docs
https://docs.guzzlephp.org/en/stable/request-options.html?highlight=veri...

I'm torn on this turning "verify": FALSE option as it says "don't" in the docs, but we can't control other people's poor SSL practices...

Here's an MR that tries to get the ball rolling and something we can test to see if it solves part of the problem.

joelpittet’s picture

joelpittet
he/him
Primary language English
Location Vancouver
commented

Should anybody need to care about their out bound links SSL certs?

joelpittet opened merge request !55

joelpittet’s picture

joelpittet
he/him
Primary language English
Location Vancouver
commented
Status: Active » Needs review
idflood’s picture

idflood commented
StatusFileSize
new linkchecker-disable-ssl-verify-3402569-7.patch375 bytes

Here is a patch file with the change from the merge request.

xjkwak’s picture

xjkwak commented

I had the issue in my local environment only. I fixed it by adding this one line to my local settings.php `settings.local.php`:

// Disable SSL verification for local Docksal environment// (self-signed certificates cause cURL error 60 in linkchecker, etc.).
$settings['http_client_config']['verify'] = FALSE;

With this config, no patch is needed any patch for it.

joelpittet’s picture

joelpittet
he/him
Primary language English
Location Vancouver
commented
Version: 2.0.x-dev » 2.1.x-dev

Moving to 2.1.x branch targetting.

joelpittet’s picture

joelpittet
he/him
Primary language English
Location Vancouver
commented

Added a configurable "Verify SSL certificates" setting under Check settings on the admin form, rather than hardcoding verify => FALSE.

  • New config optioncheck.verify_ssl with config schema and install default
  • Admin checkbox at /admin/config/content/linkchecker under Check settings
  • Defaults to disabled since the link checker only makes read-only requests and doesn't transmit sensitive data, disabling SSL verification avoids false positives from sites with self-signed or expired certificates
  • Admins who want stricter checking can enable it via the UI
joelpittet’s picture

joelpittet
he/him
Primary language English
Location Vancouver
commented

The test failures are fixed here #3582328: Fix broken tests blocking CI pipeline success

lambert’s picture

lambert commented

> Added a configurable "Verify SSL certificates" setting

Thank you for taking this non-opinionated approach.

joelpittet’s picture

joelpittet
he/him
Primary language English
Location Vancouver
commented

tests passing again, ready for review again.