SSL Certificates Don't Work From Jar #531
Description
I'm here to keep the JRuby team mired in SSL blerghs. It appears that something broke when the jruby-openssl gem moved into JRuby. This assertion may be untrue, and I'll verify against 1.7.0.
If you warble a Jar with an SSL certificate, and set the ca_file (also, verify peer) to a file that was bundled along with the Jar... You'll get an error that's something like:
#<OpenSSL::SSL::SSLError: jar:file:/Users/sgonyea/tmp/dp/PP.jar!/my_project/lib/ca-certificates.crt> - ["org/jruby/ext/openssl/SSLContext.java:229:insetup'", "org/jruby/ext/openssl/SSLSocket.java:145:in initialize'", "jar:file:/var/folders/bd/qxsdqy3d7_gg31pdjm_00lsr0000gn/T/jruby260755300623026042extract/jruby-stdlib-1.7.2.jar!/META-INF/jruby.home/lib/ruby/1.9/net/http.rb:776 [SNIP]
The code I'm using to make HTTP calls looks like:
Net::HTTP.new(uri.host, uri.port).tap do |http|
http.use_ssl = true
http.read_timeout = PP::HTTP_TIMEOUT
http.ca_file = PP.ca_file
http.verify_mode = OpenSSL::SSL::VERIFY_PEER
end
module PP
# Snipped, for how we get to the ca_file value above:
def self.ca_file
Pathname(File.expand_path File.dirname(__FILE__)).join("ca-certificates.crt").to_s
end
endObviously, the above code works if you are not working from a Jar. Warble that code into a jar (or however) and it should fail. Doing a File.read on that will return the contents of the file.
My interim solution is to simply read in the CA cert and write it out to a tmp directory. It seems that there is no obvious way to turn a Cert file (containing multiple certs) into a Cert Store from a String.
If I do a http.cert = OpenSSL::X509::Certificate.new(File.read '...') then the HTTP request times out and fails to connect, it seems. Digging around in the code, it looks like the cert is not used unless a private key is also supplied?