SSL tests may fail on modern systems using openSSL with SECLEVEL2

[dleidert]

The tests in test/test_puma_server_ssl.rb fail on a current Debian Linux system with errors like

Error:
TestPumaServerSSL#test_very_large_return:
OpenSSL::SSL::SSLError: SSL_connect SYSCALL returned=5 errno=0 state=SSLv3/TLS write client hello

After some debugging the keys and certificates have issues:

$ openssl s_server -key examples/puma/puma_keypair.pem -cert examples/puma/cert_puma.pem 
Using default temp DH parameters
error setting certificate
140711881110720:error:0909006C:PEM routines:get_name:no start line:../crypto/pem/pem_lib.c:745:Expecting: DH PARAMETERS
140711881110720:error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small:../ssl/ssl_rsa.c:310:

$ openssl s_server -key examples/puma/client-certs/client_unknown.key -cert examples/puma/client-certs/client_unknown.crt 
Using default temp DH parameters
error setting certificate
140568795444416:error:0909006C:PEM routines:get_name:no start line:../crypto/pem/pem_lib.c:745:Expecting: DH PARAMETERS
140568795444416:error:140AB18E:SSL routines:SSL_CTX_use_certificate:ca md too weak:../ssl/ssl_rsa.c:310:

Because of these issues the tests now fail. Would you mind updating the files for both the 3.12 and the 4.3 series?

To Reproduce

Configure openssl (openssl.cnf) to use

[system_default_sect]
CipherString = DEFAULT@SECLEVEL=2

and run the tests.

[nateberkopec]

Is this failing a distro's packaging system somewhere? If so, can I get a link?

[MSP-Greg]

@nateberkopec

JFYI, there have been similar issues with ruby/openssl. It's not a failure in Puma, it's an issue that test fixtures (files) were created with either insecure ciphers or key 'lengths' that were too short.

[dleidert]

@nateberkopec I've disabled the tests for the moment. The tests are successful if I manually edit the openssl configuration and use SECLEVEL=1 or override the configuration using OPENSSL_CONF='' (seems SECLEVEL=1 is the default, but Debian decided to increase the level). And yes, it is just that the keys/ciphers are weak or too short for security level 2. Can the tests override the system configuration?

[MSP-Greg]

@dleidert

Apologies for the delay. If you have time, could you see if PR #2333 fixes this issue?