Support SSL_CTX_use_certificate_chain_file for providing certificate chains

[p-mongo]

Use case: providing certificates to servers where certificates are signed by intermediate certificates, not root CAs (root CA -> intermediate -> client cert).

ruby-openssl currently uses SSL_CTX_use_certificate_file to add a certificate file to the SSL context. This works when the certificate is signed directly by a CA specified in the CA file, but does not work when the client certificate is signed by an intermediate certificate which is signed by the CA certificate.

OpenSSL appears to provide SSL_CTX_use_certificate_chain_file method (https://linux.die.net/man/3/ssl_ctx_use_certificate_chain_file) which adds the entire certificate chain to the context. As far as I can tell ruby-openssl does not reference this method anywhere in the source. An argument to this method is path to a bundle file, i.e. file which sequentially contains the client certificate and any intermediate certificates needed to get to the root CA cert.

One possible workaround to use certificates signed by intermediate certs is to take the bundle file, split it manually in the application into the separate certificates, and then use extra_chain_cert option on the context to add the intermediate certificates to the context. This is done in venuenext/ruby-kafka@9495f5d (zendesk/ruby-kafka#633) for ruby-kafka. However, manually splitting certificate bundle files seems error prone, especially given that OpenSSL natively can handle the bundles.

Is there a way to directly pass a certificate bundle to ruby-openssl such that the bundle will then be sent to the server during TLS handshake, and if not, can support for SSL_CTX_use_certificate_chain_file be added please?

[ioquatix]

I also want this.

[ioquatix]

We should add some specs/tests for this.

[ioquatix]

I've added a very basic test 10afb35

[ioquatix]

I'm playing around with this too:

module OpenSSL::X509
	CERTIFICATE_PATTERN = /-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----/m
	
	def self.load_certificates(path)
		File.read(path).scan(CERTIFICATE_PATTERN).collect do |text|
			Certificate.new(text)
		end
	end
end

[p-mongo]

Thank you!

Our current workaround: mongodb/mongo-ruby-driver@1f64d64#diff-ed625ecdabf4aeff5d1a5fc04b958a3a