Pointing to CA path and/or CA file does not work on Heroku

[thoughtpunch]

Settings Zencoder::HTTP.default_options.merge!(:ca_path => "/usr/lib/ssl/certs/") doesn't seem work on Heroku, even though this is the correct path to the system CA cert bundle. Manually pointing to the CA bundle doesn't work either.

Exception

Zencoder::HTTPError: OpenSSL::SSL::SSLError (wrapped in a Zencoder::HTTPError) - SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed

What am I doing wrong here?

[corasaurus-hex]

Would you mind giving this monkey-patch a try? We didn't have any issues on heroku, in fact we didn't even need to configure the :ca_path.

require "zencoder"

module Zencoder
  class HTTP
    class NetHTTP
      def http
        u = uri

        http = Net::HTTP.new(u.host, u.port)

        if u.scheme == 'https'
          http.use_ssl = true

          if skip_ssl_verify
            http.verify_mode = OpenSSL::SSL::VERIFY_NONE
          else
            http.verify_mode = OpenSSL::SSL::VERIFY_PEER
          end

          http.cert_store = OpenSSL::X509::Store.new
          http.cert_store.set_default_paths

          http.cert_store.add_file(ca_file) if ca_file
          http.cert_store.add_path(ca_path) if ca_path
        end

        http
      end
    end
  end
end

[crackofdusk]

I'm not using Heroku, but I had the same problem as @thoughtpunch on a VPS (where the certificate bundle was up-to-date and configuring or not the CA path had no effect on the verification error). Sorry if this should be in a separate issue.

Monkey patching to set the certificate store and default paths solved the certificate verification problem in my case.

@nate Do you think this modification can make it into the gem if it doesn't break anything?

[corasaurus-hex]

Yes, I'm making the necessary changes to make this work now. I need to confirm that it works in the various versions of ruby we support as well. I should have a new version of the library out later today.

[corasaurus-hex]

Version 2.5.1 has been pushed with these changes. @crackofdusk and @thoughtpunch: would you mind trying it out and seeing if it works for you?

[thoughtpunch]

@nate will do. Thanks so much for all the help! 👍

[corasaurus-hex]

Not a problem, and sorry for the trouble!

Interesting note: I asked around and this approach is the right way to do it:

https://github.com/drbrain/net-http-persistent/blob/master/lib/net/http/persistent.rb#L1183-L1185

That guy works on ruby core's net/http and he confirmed this is correct:

https://github.com/ruby/ruby/commits/trunk/lib/net/http.rb

[cdidyk]

FYI, I just noticed this problem today for some apps I have deployed on heroku and updating the zencoder gem from 2.4.whatever to 2.5.1 totally fixed it (I didn't have to do anything else). Thanks for the patch!