2

Is there a way to disable SSL verification by default inside download.file?

The situation is that we have an internal CRAN mirror in my company, but it uses a self-signed SSL cert. As far as I can tell, this causes download.file to fail, and since install.packages makes use of download.file, this means installing packages also fails. I'd like to turn the verification check off to see if this fixes the problem.

OS is Ubuntu 20.04 (actually running inside a container), R is 4.1.1.

Hong Ooi
  • 56,353
  • 13
  • 134
  • 187
  • What is the exact error message you are getting? – MrFlick Oct 26 '21 at 02:38
  • I diagnosed this by running curl on the commandline, which fails by default but succeeds with the `-k` flag to disable verification. I'd like to do the same inside R – Hong Ooi Oct 26 '21 at 02:40
  • running `download.file` also gives the message "status was 'SSL peer certificate or SSH remote key was not OK'" – Hong Ooi Oct 26 '21 at 02:40
  • 1
    Possible duplicate: https://stackoverflow.com/questions/47715918/how-to-pass-the-curl-insecure-alternative-when-using-r Basically you can't change the default behavior of `download.file` to make it insecure. You either need to some other utility to download it or you need to set up that machine to trust the certificate issuer (which is probably safer) – MrFlick Oct 26 '21 at 02:47
  • `download.file` has an argument `method` that can take "curl". From the help documentation > "For methods "wget" and "curl" a system call is made to the tool given by method". Perhaps worth a shot messing with that – Donald Seinen Oct 26 '21 at 03:50
  • @DonaldSeinen unfortunately the image i'm using doesn't have curl installed :( – Hong Ooi Oct 26 '21 at 04:28
  • looks like setting `options(download.file.method="curl", download.file.extra="-k -L")` will work... but requires that curl is installed – Hong Ooi Oct 26 '21 at 06:17

2 Answers2

5

It's possible to get download.file to ignore SSL issues by setting the download method to curl and specifying the appropriate flags:

# -k means don't verify cert, -L means follow redirects (important for some servers)
options(download.file.method="curl", download.file.extra="-k -L")
download.file("https://internal.server/file", "destfile")

However, this requires that the curl commandline tool is installed. This isn't the case for the Docker image I'm using, but that's another problem.

Hong Ooi
  • 56,353
  • 13
  • 134
  • 187
2

R Studio

Access menu Tools -> Global and click in Packages.

You can disable unchecking "use secure download method for HTTP".

Rodrigo Zem
  • 270
  • 9
  • 17
  • This seems like it could be an answer, but using the macOS UI, I cannot find anything which looks like what you describe. Could you add some screenshots, or perhaps add some more explicit directions? – Kenn Sebesta Dec 22 '22 at 00:42