FPHTTPClient and SSL not working
lazarus / 38-Networking and Web Programming

----------------------------------------------------------------------
geraldholdsworth · 2025-01-23 19:44

Hi all,

Following on from my post here, I've worked out that it is just HTTPS
URLs that fail. However, https://google.com works (as does
google.co.uk). I get, for Bing for example, is Connect to
www.bing.com:443 failed.
I have absolutely no idea how to find out what version of
FPHTTPClient, or OpenSSL, I am using or even where to find a newer
version or even how to install it.

I'm using Lazarus 3.0 on macOS 15.

The code is currently:
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i unit
Unit1; {$mode objfpc}{$H+} interface uses Classes, SysUtils, Forms,
Controls, Graphics, Dialogs,ExtCtrls,StdCtrls, fphttpclient, openssl,
opensslsockets; type  { TForm1 }  TForm1 = class(TForm) 
Button1:TButton;  Memo1:TMemo;  Panel1:TPanel;  procedure
Button1Click(Sender:TObject); private  public  end; var Form1:
TForm1; implementation {$R *.lfm} { TForm1 } procedure
TForm1.Button1Click(Sender:TObject);begin InitSSLInterface; With
TFPHTTPClient.Create(Nil) do begin  AllowRedirect:=True; 
AddHeader('User-Agent', 'Mozilla/5.0 (compatible; fpweb)');  try 
 try    Memo1.Lines.Add(Get('https://www.bing.com'));   except on E:
Exception do    Memo1.Lines.Add(E.Message);   end;  finally   Free; 
end; end;end; end. 
I have seen some code using "ValidateSSLCertificate" with
TFPHTTPClient, but Lazarus reports this as unknown.

----------------------------------------------------------------------
Thaddy · 2025-01-24 07:21

If you need to call InitSSLInterface then you are using a version that
is at least 12 years old.
That will unfortunately limit any support from me.
I suppose your SSL libraries are outdated too?
This minimalistic code should work, well, works:Code: Pascal
 [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i {$mode
objfpc}{$H+}uses sysutils, fphttpclient, opensslsockets;var 
client:TfpHttpClient;begin   client := TfpHttpClient.Create(nil); 
try    try      client.AllowRedirect := true;     
client.RequestHeaders.Add('User-Agent: Mozilla/5.0 (Windows NT 10.0;
Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/58.0.3029.110 Safari/537.3');     
writeln(client.get('https://www.bing.com'));    except       On
E:EHttpClient do          writeln (E.message)       else         
raise;    end;  finally    client.free;  end;end.If it does not work
your installation is hopelessly outdated and I can not help you any
further.

----------------------------------------------------------------------
TRon · 2025-01-24 07:33

https://wiki.freepascal.org/macOS_Programming_Tips#OpenSSL,_LibreSSL,_
Secure_Transport,_Network_Framework

----------------------------------------------------------------------
Thaddy · 2025-01-24 07:46

Note the above code should therefor work on all platforms that support
fcl-net.
The technical information in the wiki is maybe a bit over the top for
simple users.
Boils simply down to: be current.

----------------------------------------------------------------------
geraldholdsworth · 2025-01-24 08:17

Thank you both.

It seems, to me, that as the eventual target for the application I'm
writing is likely to be either a RaspberryPi or a Windows machine,
getting it working on a Mac is a fruitless endeavour...for now.

I have found that, for the unit I'm trying to communicate with, curl
in Terminal also works (and it also runs on Windows command line) - so
I was thinking about firing that off from a Lazarus application and
somehow harnessing the output (maybe saving the output to a file which
the application then picks up).

----------------------------------------------------------------------
Thaddy · 2025-01-24 11:45

My code works on a raspberry pi too..(all flavors)But it also works on
a mac.

----------------------------------------------------------------------
geraldholdsworth · 2025-01-25 14:33

I managed to get it running on Windows. I then compiled it for the Pi,
but it wouldn't run - could just be my inexperience with Linux..

However, looks like we're going to get a Windwos tablet PC to put this
application on, then sell to the client.

One day I'll look to get this going on a Mac.

----------------------------------------------------------------------
Thaddy · 2025-01-25 14:44

I tested the code on a RPi AARCH64 too. No problems.(but I used
trunk/main)
The only dependency is frankly the ssl libraries and these must be up-
to-date.

----------------------------------------------------------------------
TRon · 2025-01-25 17:35

Quote from: geraldholdsworth on January 25, 2025, 03:33:21 pmI managed
to get it running on Windows. I then compiled it for the Pi, but it
wouldn't run - could just be my inexperience with Linux..
"wouldn't run" is not an error. Keep in mind that nothing can be done
to help you when that is all there is to mention. Better would be to
make a small compileable example that you can test (but also share for
us to test) and run it from a terminal window. In case the libraries
are not installed or other requirements missing the system will spill
out a error message. In worse case scenario a strace is able to
provide more information on what goes wrong.

Just like Thaddy I do not have any issues as described.

----------------------------------------------------------------------
dbannon · 2025-01-25 22:48

You seem a bit reluctant to tell us what FPC you are using on Linux.
If its FPC3.2.2 you must also install the openSSL development library
(or make a symlink to the library).  Does not apply if you are using
trunk or (recommended) FPC324rc1.

I would suggest any new project based on FPC322 and SSL is not a good
idea.

Davo

----------------------------------------------------------------------
geraldholdsworth · 2025-01-26 00:05

I use my Mac to cross compile to Linux and Windows. It'll be v3.0 of
Lazarus. Not sure what the FPC version is though. I've installed the
cross compiler using FPCUpDeluxe.

I have cross compiled to Linux before, with other projects, using this
method which have run successfully. I don't run Lazarus on Linux.

----------------------------------------------------------------------
dbannon · 2025-01-26 06:12

gerald, the issue I mention is a FPC issue, relating to how old FPC322
is. Its not a Lazarus issue.

"I think" that if you cross compile from your mac to aarch64-linux (ie
raspi) using FPC322, then if your app uses SSL, you should add libssl-
dev to its Raspi version run time dependencies list (assuming a Debian
or Fedora based OS on the 'Pi, Arch for example does not need it.).

If you compile (ie cross compile) using a release candidate FPC, not a
problem.

If you depend on the $PATH (a unix approach) to find FPC at compile
time, type -
Code: Text  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i $> fpc -vh
<enter>To see the version.

Davo

----------------------------------------------------------------------
Thaddy · 2025-01-26 07:08

Gerald, why not compile on the
Rapberry pi itself?
Code: Bash  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i sudo apt
update sudo apt upgradesudo apt install fpcThis will install fpc 3.2.2
and at least on my Raspberry pi's my example works (but that also
works on a recent M series Mac)
Of course if you Pi has an old version of the OS it will still not
work because recent ssl is necessary.

----------------------------------------------------------------------
Thaddy · 2025-01-26 07:15

For openSSL type openssl version.
The openSSL version must be series 3.x.x - this is not an fpc version
-  or 1.1.1 and not earlier than 2022 preferably newer.

----------------------------------------------------------------------
BSaidus · 2025-01-26 08:34

Hi,
Verify (seek) the name of the .so library and see if the name
correspond to ones you have in your openssl unit.
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i const// SSL
and Crypto DLL arrays must have the same length and contain// matched
pairs of DLL filenames. Place newer versions at the beginning.{$IF
DEFINED(WIN64)}  SSL_DLL_Names:    array[1..4] of string =
('libssl-3-x64',    'libssl-1_1-x64',    'ssleay32', 'libssl32'); 
Crypto_DLL_Names: array[1..4] of string = ('libcrypto-3-x64',
'libcrypto-1_1-x64', 'libeay32', 'libeay32');{$ELSEIF
DEFINED(WINDOWS)}  SSL_DLL_Names:    array[1..4] of string =
('libssl-3',    'libssl-1_1',    'ssleay32', 'libssl32'); 
Crypto_DLL_Names: array[1..4] of string = ('libcrypto-3',
'libcrypto-1_1', 'libeay32', 'libeay32');{$ELSEIF DEFINED(OS2GCC)} 
SSL_DLL_Names:    array[1..2] of string = ('kssl10',   'kssl'); 
Crypto_DLL_Names: array[1..2] of string = ('kcrypt10',
'kcrypto');{$ELSEIF DEFINED(OS2)}  SSL_DLL_Names:    array[1..2] of
string = ('emssl10',  'ssl');  Crypto_DLL_Names: array[1..2] of string
= ('emcrpt10', 'crypto');{$ELSE}  BaseSSLName: string = 'libssl'; 
BaseCryptoName: string = 'libcrypto';  { ADD NEW ONES WHEN THEY
APPEAR!    Always make .so/dylib first, then versions, in descending
order!    Add "." .before the version, first is always just "" } 
DLLVersions: array[1..20] of string = ('', '.3', '.1.1', '.11', '.10',
'.1.0.6', '.1.0.5', '.1.0.4', '.1.0.3',                              
        '.1.0.2', '.1.0.1','.1.0.0','.0.9.8',                        
              '.0.9.7', '.0.9.6', '.0.9.5', '.0.9.4',                
                      '.0.9.3', '.0.9.2', '.0.9.1');  LibreSSLVersions
: Array[1..8] of string =                     ('', '.48', '.47',
'.46', '.45', '.44', '.43', '.35');   // Mac OS no longer allows you
to load the unversioned one. Bug ID 36484.  {$IFDEF DARWIN} 
StartVersionOffset = 1;  DefaultLibreSSLSupport = lssFirst;  {$ElSE} 
StartVersionOffset = 0;  DefaultLibreSSLSupport = lssLast; 
{$ENDIF} Var   LibreSSLSupport : TLibreSSLSupport =
DefaultLibreSSLSupport;{$ENDIF}       

if you find that the the existing .so library differs, then create a
symbolic name to it with a name corresponding to the ones existing in
your openssl.pas unit.

----------------------------------------------------------------------
Thaddy · 2025-01-26 09:01

Quote from: BSaidus on January 26, 2025, 09:34:05 amif you find that
the the existing .so library differs, then create a symbolic name to
it with a name corresponding to the ones existing in your openssl.pas
unit.
Ouch!

DON'T DO THAT

He may create a symlink to an old version with the link name of a
"new" version.
That is very bad advice.
Why?
The binaries must be at least from 2022, because of added tls1.3
support and removal of all ssl* and tls 1.0 support.