Skip to content

SSL_CERT_FILE environment variable is not honoured #369

@mikz

Description

@mikz

OpenSSL says SSL_CERT_FILE and SSL_CERT_DIR environment variables can be used to set default location for certificate fails. HTTPClient ignores this setting.

Net::HTTP respects that setting.

$ ruby -rnet/http -e "Net::HTTP.get URI('https://example.com/')"
$ echo $?
0
$ SSL_CERT_FILE=/etc/foo ruby -rnet/http -e "Net::HTTP.get URI('https://example.com/')"
ruby-2.3.1/lib/ruby/2.3.0/net/http.rb:933:in `connect_nonblock': SSL_connect returned=1 errno=0 state=error: certificate verify failed (OpenSSL::SSL::SSLError)

HTTPClient does not.

$ ruby -rhttpclient -e "HTTPClient.new.get_content('https://example.com/')"
$ echo $?
0
$ SSL_CERT_FILE=/etc/foo ruby -rhttpclient -e "HTTPClient.new.get_content('https://example.com/')"
$ echo $?
0

There is no system-wide way of configuring HTTPClient to use default system store and has to be initialised on per instance basis as described in #335.

Also, the bundle cacert.pem is almost 2 years old missing several important updates.

I think HTTPClient should not default to own bundled CA certificates if system provides that. That might be broken on Windows, but this breaks it on every other UNIX platform.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions