`make test` broken due to change in SSL certificate for `example.com`

[boegel]

When I run make test for LWP-Protocol-https 6.14 (on top of Perl 5.40.2), I see the following problem:

Can't connect to www.example.com:443 (certificate verify failed)

Full details:

Details

$ make test
PERL_DL_NONLAZY=1 "/software/Perl/5.40.2-GCCcore-14.3.0/bin/perl" "-MExtUtils::Command::MM" "-MTest::Harness" "-e" "undef *Test::Harness::Switches; test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
t/00-report-prereqs.t .. #
# Versions for all modules listed in MYMETA.json (including optional ones):
#
# === Configure Requires ===
#
#     Module                  Want     Have
#     ------------------- -------- --------
#     ExtUtils::MakeMaker      any     7.76
#     perl                5.008001 5.040002
#
# === Configure Suggests ===
#
#     Module      Want Have
#     -------- ------- ----
#     JSON::PP 2.27300 4.16
#
# === Build Requires ===
#
#     Module              Want Have
#     ------------------- ---- ----
#     ExtUtils::MakeMaker  any 7.76
#
# === Test Requires ===
#
#     Module                     Want     Have
#     ---------------------- -------- --------
#     ExtUtils::MakeMaker         any     7.76
#     File::Spec                  any     3.75
#     File::Temp                  any   0.2311
#     IO::Select                  any     1.55
#     IO::Socket::INET            any     1.55
#     IO::Socket::SSL           1.970    2.095
#     IO::Socket::SSL::Utils      any    2.015
#     LWP::UserAgent             6.06     6.79
#     Socket                      any    2.040
#     Test::More                 0.96 1.302214
#     Test::Needs            0.002010 0.002010
#     Test::RequiresInternet      any     0.05
#     perl                   5.008001 5.040002
#     warnings                    any     1.70
#
# === Test Recommends ===
#
#     Module         Want     Have
#     ---------- -------- --------
#     CPAN::Meta 2.120900 2.150010
#
# === Runtime Requires ===
#
#     Module                  Want     Have
#     ------------------- -------- --------
#     IO::Socket::SSL        1.970    2.095
#     LWP::Protocol::http      any     6.79
#     LWP::UserAgent          6.06     6.79
#     Net::HTTPS                 6     6.23
#     base                     any     2.27
#     perl                5.008001 5.040002
#     strict                   any     1.13
#
# === Other Modules ===
#
#     Module      Have
#     ----------- ----
#     Net::SSLeay 1.94
#
t/00-report-prereqs.t .. ok
t/diag.t ...............     # path to openssl: /software/OpenSSL/3/bin/openssl
    # stdout: OpenSSL 3.2.2 4 Jun 2024 (Library: OpenSSL 3.2.2 4 Jun 2024)
t/diag.t ............... 1/?     # Net::SSLeay::OPENSSL_VERSION_NUMBER() 0x30200020
    # IO::Select 1.55
    # IO::Socket::INET 1.55
    # IO::Socket::SSL 2.095
    # IO::Socket::SSL::Utils 2.015
    # Socket 2.040
t/diag.t ............... ok
t/example.t ............
    #   Failed test 'success status'
    #   at t/example.t line 19.

    #   Failed test 'have header Client-SSL-Socket-Class'
    #   at t/example.t line 29.

    #   Failed test 'have header Client-SSL-Cipher'
    #   at t/example.t line 44.

    #   Failed test 'found expected document content'
    #   at t/example.t line 46.
    #                   'Can't connect to www.example.com:443 (certificate verify failed)
    #
    # SSL connect attempt failed error:0A000086:SSL routines::certificate verify failed at /software/Perl-bundle-CPAN/5.40.2-GCCcore-14.3.0/lib/perl5/site_perl/5.40.2/LWP/Protocol/http.pm line 49.
    # '
    #     doesn't match '(?^:Example Domain)'
    # Looks like you failed 4 tests of 6.
t/example.t ............ 1/2
#   Failed test 'Request GET https://www.example.com'
#   at t/example.t line 47.

    #   Failed test 'success status'
    #   at t/example.t line 54.
    # Looks like you failed 1 test of 2.

#   Failed test 'Check for warnings from GET https://www.example.com (RT #81948)'
#   at t/example.t line 57.
# Looks like you failed 2 tests of 2.
t/example.t ............ Dubious, test returned 2 (wstat 512, 0x200)
Failed 2/2 subtests
t/https_proxy.t ........ ok

Test Summary Report
-------------------
t/example.t          (Wstat: 512 (exited 2) Tests: 2 Failed: 2)
  Failed tests:  1-2
  Non-zero exit status: 2
Files=4, Tests=62,  0 wallclock secs ( 0.02 usr  0.01 sys +  0.32 cusr  0.07 csys =  0.42 CPU)
Result: FAIL
Failed 1/4 test programs. 2/62 subtests failed.
make: *** [Makefile:890: test_dynamic] Error 255

This is not a bug in LWP-Protocol-https though, since I see a similar problem when using the requests Python package:

Details

$ python3 -c "import requests; requests.get('https://example.com')"
Traceback (most recent call last):
  File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 700, in urlopen
    httplib_response = self._make_request(
  File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 383, in _make_request
    self._validate_conn(conn)
  File "/usr/lib/python3.9/site-packages/urllib3/connectionpool.py", line 1015, in _validate_conn
    conn.connect()
  File "/usr/lib/python3.9/site-packages/urllib3/connection.py", line 411, in connect
    self.sock = ssl_wrap_socket(
  File "/usr/lib/python3.9/site-packages/urllib3/util/ssl_.py", line 449, in ssl_wrap_socket
    ssl_sock = _ssl_wrap_socket_impl(
  File "/usr/lib/python3.9/site-packages/urllib3/util/ssl_.py", line 493, in _ssl_wrap_socket_impl
    return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
  File "/usr/lib64/python3.9/ssl.py", line 501, in wrap_socket
    return self.sslsocket_class._create(
  File "/usr/lib64/python3.9/ssl.py", line 1074, in _create
    self.do_handshake()
  File "/usr/lib64/python3.9/ssl.py", line 1343, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1147)

I see the same problem across very different systems (Linux, macOS), which strongly suggests that the problem with the SSL certificate of https://example.com itself (which can well be, since it was recently updated, on 13 Feb 2026).

[boegel]

I'm using the following patch to dance around this problem for ow, using google.com instead of example.com:

--- LWP-Protocol-https-6.14/t/example.t.orig	2026-02-19 10:41:14.082732809 +0100
+++ LWP-Protocol-https-6.14/t/example.t	2026-02-19 10:46:40.834320072 +0100
@@ -2,7 +2,7 @@
 
 use strict;
 use Test::More;
-use Test::RequiresInternet 'www.example.com' => 443;
+use Test::RequiresInternet 'www.google.com' => 443;
 
 use LWP::UserAgent ();
 
@@ -10,7 +10,7 @@
 
 plan tests => 2;
 
-my $url = 'https://www.example.com';
+my $url = 'https://www.google.com';
 
 subtest "Request GET $url" => sub {
     plan tests => 6;
@@ -43,7 +43,7 @@
     my $ssl_cipher = $res->header($h) || '';
     ok($ssl_cipher =~ /\S/, "have header $h");
 
-    like($res->content, qr/Example Domain/, "found expected document content");
+    like($res->content, qr/<title>Google<\/title>/, "found expected document content");
 };
 
 subtest "Check for warnings from GET $url (RT #81948)" => sub {

[boegel]

relevant:

• [bug] SSL Verification Failure for example.com certifi/python-certifi#393

[oalders]

Thanks, @boegel! Closed via #91. New release has been uploaded to CPAN.