SSL errors with open()

rubyonrails-talk
1

I have web site that open ok in the browser - no errors or warnings about the certificate. When I open it with open(), I get the following error:

/Users/joe/.rvm/rubies/ruby-2.2.2/lib/ruby/2.2.0/net/http.rb:931: `SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed’ (OpenSSL::SSL::SSLError)

from /Users/joe/.rvm/rubies/ruby-2.2.2/lib/ruby/2.2.0/net/http.rb:852:in `start'

from /Users/joe/.rvm/rubies/ruby-2.2.2/lib/ruby/2.2.0/open-uri.rb:318:in `open_http'

from /Users/joe/.rvm/rubies/ruby-2.2.2/lib/ruby/2.2.0/open-uri.rb:736:in `buffer_open'

from /Users/joe/.rvm/rubies/ruby-2.2.2/lib/ruby/2.2.0/open-uri.rb:211:in `block in open_loop'

from /Users/joe/.rvm/rubies/ruby-2.2.2/lib/ruby/2.2.0/open-uri.rb:209:in `catch'

from /Users/joe/.rvm/rubies/ruby-2.2.2/lib/ruby/2.2.0/open-uri.rb:209:in `open_loop'

from /Users/joe/.rvm/rubies/ruby-2.2.2/lib/ruby/2.2.0/open-uri.rb:150:in `open_uri'

from /Users/joe/.rvm/rubies/ruby-2.2.2/lib/ruby/2.2.0/open-uri.rb:716:in `open'

from /Users/joe/.rvm/rubies/ruby-2.2.2/lib/ruby/2.2.0/open-uri.rb:34:in `open'

from t.rb:13:in `<main>'

/Users/joe/.rvm/rubies/ruby-2.2.2/lib/ruby/2.2.0/net/http.rb:931: raise exception

Trying another SSL enabled site (https://www.google.com) works ok.

Any ideas here?

Thanks,

Joe

2

It is possible you do not have a fully up to date root certificate list, root certificates are stores in the browser, but OpenSSL uses its own directory

Since you are using rvm on OS X by the look of it, so you may want to try the following command to see if this helps

rvm osx-ssl-certs update

3

I updated the SSL certs as you suggested, I still get a failure.

There is a workaround: add these 2 lines to the top of your program:

I_KNOW_THAT_OPENSSL_VERIFY_PEER_EQUALS_VERIFY_NONE_IS_WRONG = nil

OpenSSL::SSL::VERIFY_PEER = OpenSSL::SSL::VERIFY_NONE

The SSL library prints a warning, but it will run.

4

Agreed it will run, but it has obviously removed all the protection :slight_smile:

Very interested that it works in a browser however