Skip to content

Support SSL_CTX_use_certificate_chain_file for providing certificate chains #254

@p-mongo

Description

@p-mongo

Use case: providing certificates to servers where certificates are signed by intermediate certificates, not root CAs (root CA -> intermediate -> client cert).

ruby-openssl currently uses SSL_CTX_use_certificate_file to add a certificate file to the SSL context. This works when the certificate is signed directly by a CA specified in the CA file, but does not work when the client certificate is signed by an intermediate certificate which is signed by the CA certificate.

OpenSSL appears to provide SSL_CTX_use_certificate_chain_file method (https://linux.die.net/man/3/ssl_ctx_use_certificate_chain_file) which adds the entire certificate chain to the context. As far as I can tell ruby-openssl does not reference this method anywhere in the source. An argument to this method is path to a bundle file, i.e. file which sequentially contains the client certificate and any intermediate certificates needed to get to the root CA cert.

One possible workaround to use certificates signed by intermediate certs is to take the bundle file, split it manually in the application into the separate certificates, and then use extra_chain_cert option on the context to add the intermediate certificates to the context. This is done in venuenext/ruby-kafka@9495f5d (zendesk/ruby-kafka#633) for ruby-kafka. However, manually splitting certificate bundle files seems error prone, especially given that OpenSSL natively can handle the bundles.

Is there a way to directly pass a certificate bundle to ruby-openssl such that the bundle will then be sent to the server during TLS handshake, and if not, can support for SSL_CTX_use_certificate_chain_file be added please?

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions