#!/usr/bin/perl

use strict;
use warnings;

use IO::Socket::SSL;

my $host = 'www.debian.org';
my $ca = 'China_Internet_Network_Information_Center_EV_Certificates_Root';
# definitely NOT the www.debian.org's CA ---^
my $cafile = "/usr/share/ca-certificates/mozilla/$ca.crt";
-r $cafile or die "$cafile: $!";

IO::Socket::SSL::set_defaults(
    SSL_verify_mode => SSL_VERIFY_PEER,
    SSL_verifycn_scheme => 'http',
    SSL_ca_file => $cafile,
    # SSL_ca_path => undef,
    # ^-- uncommenting this magically fixes the problem
);

IO::Socket::SSL::set_args_filter_hack('use_defaults');

my $sock = IO::Socket::SSL->new(
    PeerAddr => $host,
    PeerPort => 'https',
) or die IO::Socket::SSL::errstr;

print "Eeek! Connected to $host, even though only $ca was supposed to be trusted.\n";

$sock->close();
