<p><div><div><div><div data-show-faces="false" data-height="21" data-width="100" data-layout="button_count" data-send="true" data-href="https://www.r-bloggers.com/changes-to-internet-connectivity-in-r-on-windows/"></div></div><div></div></div><div></div></div>
<div>
(This article was first published on <strong><a href="http://ropensci.org/blog/technotes/2017/10/10/curl-30"> rOpenSci Blog</a></strong>, and kindly contributed to <a rel="nofollow" href="https://www.r-bloggers.com/">R-bloggers)</a> </div>
<p>This week we released version 3.0 of the <a rel="nofollow" href="https://cran.r-project.org/web/packages/curl/vignettes/intro.html" target="_blank">curl</a> R package to CRAN. You may have never used this package directly, but <code>curl</code> provides the foundation for most HTTP infrastructure in R, including <code>httr</code>, <code>rvest</code>, and all packages that build on it. If R packages need to go online, chances are traffic is going via curl.</p>
<p>This release introduces an important change for Windows users: we are switching from OpenSSL to Secure Channel on Windows 7 / 2008-R2 and up. Let me explain this in a bit more detail.</p>
<h2>Why Switching SSL backends</h2>
<p>The <a rel="nofollow" href="https://curl.haxx.se/libcurl/" target="_blank">libcurl</a> C library requires an external crypto library to provide the SSL layer (the S in HTTPS). On Linux / MacOS, libcurl is included with the OS so we don't worry about this. However on Windows we ship our own build of libcurl so we can choose if we want to build against <a rel="nofollow" href="https://www.openssl.org/" target="_blank">OpenSSL</a> or Windows native SSL api called <a rel="nofollow" href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa380123(v=vs.85).aspx" target="_blank">Secure Channel</a>, also referred to as just &quot;WinSSL&quot;.</p>
<p>Thus far we have always used libcurl with OpenSSL, which works consistently on all versions of Windows. However OpenSSL requires that we provide our own CA bundle, which is not ideal. In particular users on corporate / government networks have reported difficulty connecting to the internet in R. The reason is often that their enterprise gateway / proxy uses custom certificates which are installed in the Windows certificate manager, but are not present in R's bundle.</p>
<p>Moreover shipping our own CA bundle can be a security risk. If a CA gets hacked, the corresponding certificate needs to be revoked immediately. Operating systems can quickly push a security update to all users, but we cannot do this in R.</p>
<h2>Switching to WinSSL</h2>
<p>If we build libcurl against Windows native <a rel="nofollow" href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa380123(v=vs.85).aspx" target="_blank">Secure Channel</a>, it automatically uses the same SSL certificates as Internet Explorer. Hence we do not have to ship and maintain a custom CA bundle. Earlier this year I tried to switch the <code>curl</code> package to WinSSL, and everything seemed to work great on my machine.</p>
<p>However when we started checking reverse dependecies on CRAN WinBuilder, many packages depending on curl started to fail! It turned out Windows versions before Windows 7 do not natively support TLS 1.1 and 1.2 by default. Because TLS 1.2 is used by the majority of HTTPS servers today, WinSSL is basically useless on these machines. Unfortunately this also includes CRAN WinBuilder which runs Windows 2008 (the server edition of Vista).</p>
<p>So we had no choice but to roll back to OpenSSL in order to keep everything working properly on CRAN. Bummer.</p>
<h2>Towards Dual SSL</h2>
<p>I had almost given up on this when a few weeks ago Daniel Stenberg posted the following <a rel="nofollow" href="https://curl.haxx.se/mail/lib-2017-08/0118.html" target="_blank">announcement</a> on the libcurl mailing list:</p>
<blockquote>
<p>Hi friends!<br>
As of minutes ago, libcurl has the ability to change SSL backend dynamically<br>
at run-time – if built with the support enabled. That means that the choice<br>
does no longer only have to happen at build-time.</p>
</blockquote>
<p>This new feature gives us exactly the flexibility we need. We can take advantage of native Secure Channel on Windows 7 and up which are almost all users. However we can keep things working in legacy servers by falling back on OpenSSL on these machines, including the CRAN win builder.</p>
<p><a rel="nofollow" href="https://github.com/cran/curl/blob/3.0/src/ssl.c#L11-L17" target="_blank"><img alt="code" src="https://i0.wp.com/ropensci.org/assets/blog-images/curl30.png?w=456" data-recalc-dims="1"></a></p>
<p>So this is where we are. Version 3.0 of the curl R package uses the latest <a rel="nofollow" href="https://github.com/rwinlib/libcurl/releases" target="_blank">libcurl 7.56.0</a> and automatically switches to native SSL on Windows 7 and up. If all goes well, nobody should not notice any changes, except those people on enterprise networks where things will, hopefully, magically start working.</p>
<h2>Feedback</h2>
<p>Because each Windows network seems to have a different setup, testing and debugging these things is often difficult. We are interested to hear from Windows users if updating to curl 3.0 has improved the situation, or if any unexpected side effects arise. Please <a rel="nofollow" href="https://github.com/jeroen/curl/issues" target="_blank">open an issue</a> on Github if you run into problems.</p>
	<p>
<div>
<div>To <strong>leave a comment</strong> for the author, please follow the link and comment on their blog: <strong><a href="http://ropensci.org/blog/technotes/2017/10/10/curl-30"> rOpenSci Blog</a></strong>.</div>
<hr>
<a rel="nofollow" href="https://www.r-bloggers.com/">R-bloggers.com</a> offers <strong><a rel="nofollow" href="https://feedburner.google.com/fb/a/mailverify?uri=RBloggers">daily e-mail updates</a></strong> about <a rel="nofollow" href="https://www.r-project.org/" title="The R Project for Statistical Computing">R</a> news and <a rel="nofollow" href="https://www.r-bloggers.com/search/tutorial" title="R tutorials">tutorials</a> on topics such as: <a rel="nofollow" href="https://www.r-bloggers.com/search/data%20science" title="Data science">Data science</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/Big%20Data" title="Big Data">Big Data, <a rel="nofollow" href="https://www.r-users.com/" title="R jobs">R jobs</a>, visualization (<a rel="nofollow" href="https://www.r-bloggers.com/search/ggplot2" title="ggplot and ggplot2 tutorials">ggplot2</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/boxplot" title="Boxplots using lattice and ggplot2 tutorials">Boxplots</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/map" title="Maps and gis">maps</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/animation" title="Animation in R">animation</a>), programming (<a rel="nofollow" href="https://www.r-bloggers.com/search/RStudio" title="RStudio IDE for R">RStudio</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/sweave" title="Sweave and literate programming">Sweave</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/LaTeX" title="LaTeX in R">LaTeX</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/SQL" title="SQL and databases">SQL</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/eclipse" title="Eclipse IDE for R">Eclipse</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/git" title="git and github, Version Control System">git</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/hadoop" title="Large data in R using Hadoop">hadoop</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/Web+Scraping" title="Web Scraping of google, facebook, yahoo, twitter and more using R">Web Scraping</a>) statistics (<a rel="nofollow" href="https://www.r-bloggers.com/search/regression" title="Regressions and ANOVA analysis tutorials">regression</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/PCA" title="principal component analysis tutorial">PCA</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/time+series" title="Time series">time series</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/trading" title="finance trading">trading</a>) and more...
<img width="1" alt="" src="http://feeds.feedburner.com/~r/RBloggers/~4/ic8ZD-fKFmg" height="1"></a></div>