-
Notifications
You must be signed in to change notification settings - Fork 179
Description
Use case: providing certificates to servers where certificates are signed by intermediate certificates, not root CAs (root CA -> intermediate -> client cert).
ruby-openssl currently uses SSL_CTX_use_certificate_file to add a certificate file to the SSL context. This works when the certificate is signed directly by a CA specified in the CA file, but does not work when the client certificate is signed by an intermediate certificate which is signed by the CA certificate.
OpenSSL appears to provide SSL_CTX_use_certificate_chain_file method (https://linux.die.net/man/3/ssl_ctx_use_certificate_chain_file) which adds the entire certificate chain to the context. As far as I can tell ruby-openssl does not reference this method anywhere in the source. An argument to this method is path to a bundle file, i.e. file which sequentially contains the client certificate and any intermediate certificates needed to get to the root CA cert.
One possible workaround to use certificates signed by intermediate certs is to take the bundle file, split it manually in the application into the separate certificates, and then use extra_chain_cert
option on the context to add the intermediate certificates to the context. This is done in venuenext/ruby-kafka@9495f5d (zendesk/ruby-kafka#633) for ruby-kafka. However, manually splitting certificate bundle files seems error prone, especially given that OpenSSL natively can handle the bundles.
Is there a way to directly pass a certificate bundle to ruby-openssl such that the bundle will then be sent to the server during TLS handshake, and if not, can support for SSL_CTX_use_certificate_chain_file be added please?