Using ssl_verifypeer = FALSE in a CRAN pkg?

Question

I have an API package on CRAN that provides an interface with a United Nations DB (link to UN site), it's built using httr, which uses the curl package. I discovered yesterday that the core functions of my package were no longer working properly on Windows machines, they all fail with the error message:

Error in curl::curl_fetch_memory(url, handle = handle) : Peer certificate cannot be authenticated with given CA certificates

Which basically means there's a CA certificate issue preventing curl from completing the connection. After looking into this a bit, I believe the UN site hosting the DB is the issue, its SSL certificate is invalid per ssldecoder (see this link).

One easy fix to circumvent this issue is to add param ssl_verifypeer = FALSE to all calls to httr::GET(). However this is not an ideal solution for security reasons, since it bascially tells curl to make the connection regardless of the validity of the site's certificate.

My question is, what is the consensus on using this parameter within a CRAN package? Keeping in mind that the UN website is (presumably) safe?

Answer 1

I don't know about consensus, but Hadley writes:

You should NEVER use ssl.verifypeer = FALSE as a default, unless you don't want to know when your security has been compromised.

That said, I have seen packages using the option by default.

The question is: without a valid certificate, how do you know that the UN website has not been compromised?

I would suggest flagging the issue clearly at the top of the package documentation and indicating that it's the users responsibility to set the option. And hoping that the hosting service sorts out its certificate soon.