Created attachment 1012341 [details]
Script that demonstrates the problem

Description of problem:
The version of Net::LDAP in the perl-LDAP package sets a global "SSL_verifycn_name" option in IO::Socket::SSL that causes any later SSL/TLS use (such as by LWP::UserAgent) to fail on verification.

Version-Release number of selected component (if applicable):
perl-LDAP-0.56-3.el7.noarch

Steps to Reproduce:
1. in a perl script, use Net::LDAP to connect to an ldap server with TLS enabled and certificate verified. Something like this:
my $ldap = Net::LDAP->new($ldaps_server);
my $msg = $ldap->start_tls(
  verify => 'require',
  cafile => '/etc/pki/tls/certs/ca-bundle.crt',
);

2. Later in that same perl script, do something else with SSL or TLS, such as use LWP to connect to an https URL, such as this:
my $lwp = LWP::UserAgent->new();
my $res = $lwp->get($https_url);
if ($res->is_success) {
  print "LWP connected to $https_url\n";
} else {
  print IO::Socket::SSL::errstr(),"\n";
  die $res->status_line;
}

Actual results:
IO::Socket::IP configuration failed SSL connect attempt failed with unknown error error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

Expected results:
Successful connection and SSL/TLS verification.

Additional info:
This can be worked around by unsetting the global option in IO::Socket::SSL, like this:
IO::Socket::SSL::set_defaults(SSL_verifycn_name => undef);

If the same https connection is made prior to the ldap connection, there is no problem.

This workaround is not needed on RHEL6.6 or on Fedora 21.

I'm attaching a script that demonstrates the problem. Run with "--enableworkaround" to unset the variable.