Add configuration option to allow invalid/unverified or (self certified) SSL certificates

I just ran into this problem as well, but in the 6.x branch (running beta10). I'll use the same trick from #1 for now, but would love to have a more robust solution. FWIW, the SSL cert in question is valid, so I'm not sure why a false positive is being reported.

Subscribe. Note that importing Twitter XML feeds (via Feeds XPath Parser) results in the same error on the 6.x branch.

Should not have subscribed to this thread, and really this should not be an issue for Feeds but should be dealt with through curl command line. See here for details.

Please test the following patch - we should likely ignore SSL errors by default since they're pretty common.

[edit]
My only recommendation would be to keep it enabled by default, as this might be indicative of other problems that would go unnoticed if accept_invalid_cert is set to TRUE by default.

If we ignore, we can no longer get the error message I believe.

You're right I realized that after posting. Really I just think accept_invalid_cert should be FALSE by default, otherwise there's potential security issues. If libcurl performs SSL cert verifications by default, my thought is that Feeds should too.

Patch didn't apply to -dev. It works thou.

Ignore previous patch. One line was missing.

I'm confused, so we should actually just have the change from 0 to FALSE on line 171?

What's the status on this? Any plans on getting this functionality into the module?

@kerasai, get the latest patch an test it. If it works well, please report, as this is an important step for getting it into the module.

I'm wondering if the solution proposed here could allow a man-in-the-middle attack as outlined here: http://ademar.name/blog/2006/04/curl-ssl-certificate-problem-v.html

If we were to do this, it would have to be secure by default.

It would have to be a configuration option on the HTTPFetcher page, that's hidden in the Advanced settings fieldset, and it would have to have a HUGE DISCLAIMER that this is a bad idea, and only to be used during development, yadada.

Patch added. Meets all requirements set out in #14 and works for my use case which I believe matches the original issue.

There's a new setting in the HTTPFetcher advanced settings configuration, complete with disclaimer which sets a config variable using the name already used in the code. If set it triggers the curl option to ignore validation errors that was already in the code.

By default this is off.

The patch was made in subversion since that's what we use but hopefully that should work OK for you? It was written against the latest 7.x dev release.

The patch in #15 works great but had some issues with coding standards.

Here is a new patch that changes the tabs to spaces, removes the white space errors, and fixes the indentions.

Thanks everyone for fixing this issue. Before this patch, I couldn't import content from a Google spreadsheet with out seeing PHP curl SSL certificate errors.

This patch should apply against the latest 2.x-dev

I've tested the patch in #21 and I can confirm that with it I can now import data from drupal.org's RSS feed: https://www.drupal.org/node/feed, so I guess it is working as suggested. (Before applying the patch I got the following error: "cURL error (60) SSL certificate problem: unable to get local issuer certificate for https://www.drupal.org/node/feed")

I noticed two things in the code:

1. +++ b/plugins/FeedsHTTPFetcher.inc
   @@ -56,6 +64,10 @@ class FeedsHTTPFetcherResult extends FeedsFetcherResult {
   +
   +  public function setAcceptInvalidCert($accept_invalid_cert) {
   +    $this->accept_invalid_cert = $accept_invalid_cert;
   +  }
   

   No function docs.

2. +++ b/plugins/FeedsHTTPFetcher.inc
   @@ -176,6 +190,12 @@ class FeedsHTTPFetcher extends FeedsFetcher {
          '#maxlength' => 3,
          '#size'=> 30,
        );
   +  $form['advanced']['accept_invalid_cert'] = array(
   +    '#type' => 'checkbox',
   +    '#title' => t('Accept invalid SSL certificates'),
   +    '#description' => t('<b>IMPORTANT:</b> This setting will force curl to completely ignore all SSL errors.  This is potentially a <b>major security risk</b> and should be used with caution.'),
   +    '#default_value' => $this->config['accept_invalid_cert'],
   +  );
   
        return $form;
      }
   

   This has the wrong indention.

I fixed these in the attached patch. I also saw HTML is used inside a translatable string, but according to https://www.drupal.org/node/322774 things like <strong> are allowed.

Thanks @MegaChriz. The patch in #22 applied, is cleaned up, documented, and it works for me.

Made some more coding standard fixes and made the language even stronger.

I am still getting this error importing from api using import.io

help appreciated

@held69
There is a bug when you use this feature in combination with the "auto detect feeds" option enabled: #2419111: Configuration option to allow invalid SSL certificates is not used when option "Auto detect feeds" is enabled

@MegaChriz
Thanks,

However, i am using Feeds in conjuntion with the 'import io' feeds module:
https://www.drupal.org/project/feeds_import_io

In the settings of this importer there is no such setting as 'Autodetect' or 'allow invalid SSL certificates'

For the record:
I am using latest dev from git

feeds_import_io seems to provide its own fetcher called "import.io Fetcher". This issue only applies to the HTTP Fetcher included with Feeds, not to fetchers provided by contributes modules. Open a new issue for the feeds_import_io module. In that issue you could point to this issue, so the maintainer of feeds_import_io can create a similar fix.

Issue created:
https://www.drupal.org/node/2469949