Fail hard if SSL certs or keys cannot be read by user

lib/puma/minissl.rb

@@ -214,14 +214,19 @@ def initialize
         @cert_pem = nil
       end
 
+      def check_file(file, desc)
+        raise ArgumentError, "#{desc} file '#{file}' does not exist" unless File.exist? file
+        raise ArgumentError, "#{desc} file '#{file}' is not readable" unless File.readable? file
+      end
+
       if IS_JRUBY
         # jruby-specific Context properties: java uses a keystore and password pair rather than a cert/key pair
         attr_reader :keystore
         attr_accessor :keystore_pass
         attr_accessor :ssl_cipher_list
 
         def keystore=(keystore)
-          raise ArgumentError, "No such keystore file '#{keystore}'" unless File.exist? keystore
+          check_file keystore, 'Keystore'
           @keystore = keystore
         end
 
@@ -240,17 +245,17 @@ def check
         attr_accessor :verification_flags
 
         def key=(key)
-          raise ArgumentError, "No such key file '#{key}'" unless File.exist? key
+          check_file key, 'Key'
           @key = key
         end
 
         def cert=(cert)
-          raise ArgumentError, "No such cert file '#{cert}'" unless File.exist? cert
+          check_file cert, 'Cert'
           @cert = cert
         end
 
         def ca=(ca)
-          raise ArgumentError, "No such ca file '#{ca}'" unless File.exist? ca
+          check_file ca, 'ca'
           @ca = ca
         end
 

test/test_minissl.rb

@@ -9,21 +9,54 @@ def test_raises_with_invalid_keystore_file
       ctx = Puma::MiniSSL::Context.new
 
       exception = assert_raises(ArgumentError) { ctx.keystore = "/no/such/keystore" }
-      assert_equal("No such keystore file '/no/such/keystore'", exception.message)
+      assert_equal("Keystore file '/no/such/keystore' does not exist", exception.message)
+    end
+
+    def test_raises_with_unreadable_keystore_file
+      ctx = Puma::MiniSSL::Context.new
+
+      File.stub(:exist?, true) do
+        File.stub(:readable?, false) do
+          exception = assert_raises(ArgumentError) { ctx.keystore = "/unreadable/keystore" }
+          assert_equal("Keystore file '/unreadable/keystore' is not readable", exception.message)
+        end
+      end
     end
   else
     def test_raises_with_invalid_key_file
       ctx = Puma::MiniSSL::Context.new
 
       exception = assert_raises(ArgumentError) { ctx.key = "/no/such/key" }
-      assert_equal("No such key file '/no/such/key'", exception.message)
+      assert_equal("Key file '/no/such/key' does not exist", exception.message)
+    end
+
+    def test_raises_with_unreadable_key_file
+      ctx = Puma::MiniSSL::Context.new
+
+      File.stub(:exist?, true) do
+        File.stub(:readable?, false) do
+          exception = assert_raises(ArgumentError) { ctx.key = "/unreadable/key" }
+          assert_equal("Key file '/unreadable/key' is not readable", exception.message)
+        end
+      end
     end
 
     def test_raises_with_invalid_cert_file
       ctx = Puma::MiniSSL::Context.new
 
       exception = assert_raises(ArgumentError) { ctx.cert = "/no/such/cert" }
-      assert_equal("No such cert file '/no/such/cert'", exception.message)
+      assert_equal("Cert file '/no/such/cert' does not exist", exception.message)
+    end
+
+    def test_raises_with_unreadable_cert_file
+      ctx = Puma::MiniSSL::Context.new
+
+      File.stub(:exist?, true) do
+        File.stub(:readable?, false) do
+          exception = assert_raises(ArgumentError) { ctx.key = "/unreadable/cert" }
+          assert_equal("Key file '/unreadable/cert' is not readable", exception.message)
+        end
+      end
     end
 
     def test_raises_with_invalid_key_pem
@@ -33,6 +66,17 @@ def test_raises_with_invalid_key_pem
       assert_equal("'key_pem' is not a String", exception.message)
     end
 
+    def test_raises_with_unreadable_ca_file
+      ctx = Puma::MiniSSL::Context.new
+
+      File.stub(:exist?, true) do
+        File.stub(:readable?, false) do
+          exception = assert_raises(ArgumentError) { ctx.ca = "/unreadable/cert" }
+          assert_equal("ca file '/unreadable/cert' is not readable", exception.message)
+        end
+      end
+    end
+
     def test_raises_with_invalid_cert_pem
       ctx = Puma::MiniSSL::Context.new