HTTR package: SSL certificate error, SSL3_GET_SERVER_CERTIFICATE

2
votes

I am facing a challenge when trying to use the HTTR package in R and the GET() function:

pg2 = GET("http://httpbin.org/basic-auth/user/passwd", authenticate("user","passwd"))

and i am getting the below error:

Error in function (type, msg, asError = TRUE)  : 
  SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

I have searched on the web and found that I need to update the .Rprofile file using the below command line:

options(RCurlOptions = list(verbose = FALSE, capath = system.file("CurlSSL", "cacert.pem", package = "RCurl"), ssl.verifypeer = FALSE))

but still it doesn't work and I keep getting the same error message.

also when i tried the below code

> HEAD("https://www.google.com", verbose())
  • About to connect() to www.google.com port 443 (#0)
  • Trying 173.194.32.211... * connected
  • Connected to www.google.com (173.194.32.211) port 443 (#0)
  • successfully set certificate verify locations:
  • CAfile: C:/Users/malek.safa/Documents/R/win-library/3.0/httr/cacert.pem CApath: none
  • SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
  • Closing connection #0 Error in function (type, msg, asError = TRUE) : SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

you can see that it is still looking for the CA in the cacert.pm file

1
rsslca

1 Answers

3
votes

I spent about five hours playing with curl and RCurl. I was able to get it working. The option you want is cainfo, not capath. Capath tells RCurl where to look for the certificate file. Cainfo specifies a file.

This works for me with RCurl.

library(RCurl)
cer_file <- "/home/user/curltest/cacert.pem"
server_url <- "some_server"
getURL(server_url, cainfo=cer_file)

Now the question is how to get httr to understand this setting. The documentation talks about a default ca_cert, but doesn't explain how to use a different cert. In my case, I'm connecting to an intranet site that wouldn't be in the default cert. The answer lies in config.R. Httr allows us to set RCurl configuration options as I've done below.

cer_file <- "/home/me/curltest/cacert.pem"
GET(login_url, config=list(cainfo=cer_file))

If you are connecting to the internet, you probably just need to update the default cacert that comes with HTTR. The Readme shows you how to do this. This way you don't need to specify the cert in every call.

setwd("path to httr package")
GET("https://raw.githubusercontent.com/bagder/ca-bundle/e9175fec5d0c4d42de24ed6d84a06d504d5e5a09/ca-bundle.crt",
write_disk("inst/cacert.pem", overwrite = TRUE))