[Solved] HTTPS connection problem
lazarus / 38-Networking and Web Programming

----------------------------------------------------------------------
pleumann · 2023-05-13 09:31

Hello,

I am trying to implement a simple HTTPS downloader. I have
TFPHttpClient from WebLaz 1.0. I use the OpenSSL, OpenSSLSockets and
FPHttpClient units and do InitSSLInterface first thing in my program.

My downloader code looks like this, Source being the remote URL and
Target being the disk file name. Redirects are enabled. I am aware I
should not actually do this in the OnClick handler.  It's just a test.

procedure TForm1.Button1Click(Sender: TObject);
begin
  try
    Client.Get(Source, Target);
  except
    on E: Exception do
      ShowMessage(E.Message);
  end;
end;

It works fine for some sites, and fails with "ESocketError: Connect to
xyz.com:443 failed" for others. I wonder how I could debug that
further.

Cheers
Joerg

----------------------------------------------------------------------
pleumann · 2023-05-18 07:08

Found myself unable to solve this. There were some Google hints,
though, that the Free Pascal HTTPS implementation might have problems
with certain websites (certificate validation, I assume) depending on
OS, OS version and native SSL library involved. I gave up here and
instead called curl to to the job in the background, communicating the
progress to my GUI program via stdout/stderr.

----------------------------------------------------------------------
Jurassic Pork · 2023-05-18 07:33

hello,
what is your O.S and your fpc lazarus versions ?
Friendly, J.P

----------------------------------------------------------------------
pleumann · 2023-05-18 08:14

Quote from: Jurassic Pork on May 18, 2023, 09:33:46 amhello,
what is your O.S and your fpc lazarus versions ?
Friendly, J.P


Hi,

MacOS Monterey 12.6.4 on an Intel Mac, Free Pascal 3.2.2, Lazarus
2.2.6. These are two sample sites I tried: https://adventofcode.com
works, https://github.com doesn't.

I am grateful for any pointers, although I will probably keep my
solution as-is because it actually works nicely (there are other
external programs involved, so the overall approach is kind of
consequent). But it would be nice to know for future projects.

Cheers
Joerg

----------------------------------------------------------------------
Jurassic Pork · 2023-05-18 08:58

check version of your openssl libraries in your o.s (libcrypto,
libssl)

----------------------------------------------------------------------
TRon · 2023-05-18 09:46

Small reminder about this for MacOS.

----------------------------------------------------------------------
Jurassic Pork · 2023-05-18 10:01

Quote from: TRon on May 18, 2023, 11:46:57 amSmall reminder about this
for MacOS.
github https use TLS 1.2 only available for openssl since version
1.0.1

----------------------------------------------------------------------
pleumann · 2023-05-19 11:41

Thanks for the pointers, guys, especially the Mac-specific page. I
suspected something like TLS 1.2, but didn't know how to pinpoint it.
The Mac SSL situation seems to be a bit embarrassing (thanks, Apple!).
I can see how that creates problems for FPC. As I wrote, I like my
current Curl workaround, but I'm sure the hints will be useful in a
future project. I wonder if I might pull in a newer OpenSSL library
via MacPorts. Would FPC automatically use that (based on the position
in $PATH or so)?

Cheers
Joerg

----------------------------------------------------------------------
Jurassic Pork · 2023-05-20 06:47

hello,
you can try to install openssl 1.1 with brew :
Quotebrew install openssl@1.1then link libraries with symbolic links :
Quotesudo ln -s /opt/local/lib/openssl-1.1/libssl.1.1.dylib
/usr/local/lib
sudo ln -s /opt/local/lib/openssl-1.1/libcrypto.1.1.dylib
/usr/local/lib
code to check if it is ok in Lazarus : Code: Pascal
 [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i
implementationuses fphttpclient,opensslsockets;{$R *.lfm} { TForm1
} procedure TForm1.Button1Click(Sender: TObject);const  check_url =
'https://github.com/';var  cl : TFPHTTPClient;begin 
Memo1.Append('Accessing '+check_url);  Application.ProcessMessages; 
cl := TFPHTTPClient.Create(Form1);  try    cl.AllowRedirect := True; 
   Memo1.Append(cl.Get(check_url));  except    on E: Exception do    
MessageDlg ('Error accessing ' + check_url + LineEnding + E.ClassName
+ ':'        + LineEnding + E.Message,        mtError, [mbOK], 0); 
end;  cl.Free; end;
Friendly, J.P

----------------------------------------------------------------------
pleumann · 2023-05-20 13:08

It works now!  I used MacPorts, but the rest was basically the same.
One small gotcha: I was testing this on an Arm Mac today and still got
the error message. Then I noticed my Lazarus is generating Intel
binaries (*). Once I switched that to Arm64 everything was fine (and
my app started much faster - yay).

(*) May be the default or be caused by me moving this project around
between an Intel Mac, an Arm Mac, an Intel Linux machine and a
Raspberry PI.

Thanks!
Joerg

PS: Do you know what the long-term plan for this is? OpenSSL 1.1 will
be EOL this September. Will FPC switch to OpenSSL 3.0 then?