Switch from SSL to TLS connection - perl

Question

I have a Perl script which was using SSL for some file upload to server. Now we need to change this to TLS. As I am not aware how to do this, could someone help. Below is the block handling the certificate function.
sub check_ssl_cert {
use Net::SSLeay;
Net::SSLeay::set_proxy("proxye.hypo.de",80);
# $Net::SSLeay::trace = 9 if ($opt_d);
my ($page, $response, $headers, $server_cert) = Net::SSLeay::get_https3("$buba_srv", 443, "/");
print DEBUG "\n","#"x80,"\n", 'CERT: ' . $server_cert . "\n","-"x80,"\n" . $headers . "\n","-"x80,"\n" if ($opt_d);
if (!defined($server_cert) || ($server_cert == 0)) {
my $subject="Der BuBa Server gibt kein Zertifikat raus. Mit denen red ich nicht.";
my $message="HTTP Response: <" . $response . ">\n" .
"HTTP Headers: ---------------------------------------------------------------\n" .
$headers .
"HTTP Body: -------------------------------------------------------------------\n" .
$page .
"------------------------------------------------------------------------------\n" ;
&send_errormail($buba_srv, $subject, $message);
exit 5;
}
my $ssl_subject_name = Net::SSLeay::X509_NAME_oneline(Net::SSLeay::X509_get_subject_name($server_cert));
my $ssl_issuer_name = Net::SSLeay::X509_NAME_oneline(Net::SSLeay::X509_get_issuer_name($server_cert));
}
}

Answer 1

You are already using TLS. “SSL” is the name for old versions of the protocol, “TLS” is the name for new versions. Most websites no longer accept connections with the versions of the protocol that are officially called “SSL”. Here's a summary of the status of TLS versions:
SSLv1: so broken it wasn't even released publicly.
SSLv2: old and buried.
SSLv3: broken, don't use unless you have an ancient device that you can't upgrade and that is on a well-protected network, not Internet-facing.
TLSv1.0: deprecated but can still be used safely.
TLSv1.1: deprecated but can still be used safely.
TLSv1.2: recommended.
TLSv1.3: coming soon.
You can call Net::SSLeay::get_options to check whether SSLv3 is disabled, i.e. to check that your client will refuse to connect to an SSLv3-only server. You should ensure that SSLv3 is disabled on your client: an attacker who wanted to break your security might pretend to be the legitimate server, get your client to connect, and then exploit a vulnerability of the old protocol to be able to successfully impersonate the legitimate server. Since you're connecting to a specific server, if that server supports TLS 1.2, also disable TLS 1.0 and 1.1, by calling Net::SSLeay::set_options.

Answer 2

This is an sample how to switch to LWP and enforce TLS1.2:
use LWP::UserAgent;
my $ua = LWP::UserAgent->new(
ssl_opts => {
SSL_version => 'TLSv12:!SSLv2:!SSLv3:!TLSv1:!TLSv11',
}
);
$ua->timeout(30);
my $response = $ua->get('https://www.example.com/');

Answer 3

... = Net::SSLeay::get_https3("$buba_srv", 443, "/");
There is nothing in your code which limits the access to SSL (you probably mean SSL 3.0) only. In fact, unless $Net::SSLeay::ssl_version was explicitly set differently get_https3 will create a default SSL context which will use by default the best SSL/TLS version the underlying OpenSSL library supports, which is TLS 1.2 since OpenSSL 1.0.1 (released 2012).
Thus, if your code does not already use TLS 1.2 (have you even checked?) then check if $Net::SSLeay::ssl_version is set somewhere in your code or if your OpenSSL version is too old.
Apart from that, I really recommend against using Net::SSLeay::get_https3 and similar. These function do not properly validate the certificate (this is documented) so you will not realize if their is a man in the middle attack unless you explicitly add your own validation - which is not trivial and your code does not even attempt to do it.
Instead use higher level modules like LWP::UserAgent which makes doing HTTPS simple, uses sane defaults (at least in the current versions) and also properly validates the certificate:
use LWP::UserAgent;
my $ua = LWP::UserAgent->new;
$ua->proxy(https => "http://proxye.hypo.de:80");
my $response = $ua->get("https://$buba_srv/");
my $page = $response->decoded_content;
my $headers = $response->headers->as_string;
You can also use HTTP::Tiny or Mojo::UserAgent. But contrary to LWP you need to explicitly enable proper certificate validation when using these modules by using verify_SSL option with HTTP::Tiny and the ca argument with Mojo::UserAgent.