stevegraham / certified

Ensure net/https uses OpenSSL::SSL::VERIFY_PEER to verify SSL certificates and provides certificate bundle in case OpenSSL cannot find one

Hi there 👋

I'm the co-founder and CEO of Teller. We make awesome banking APIs that enable you to easily connect your app with user bank accounts. To do this we reverse engineer native mobile banking apps, build our own tooling (sometimes in handcoded assembly language), and build bullet-proof production services in Elixir Lang. We sometimes do other crazy stuff like build our own distributed 4G LTE proxy network using Raspberry Pi's and Nerves. Basically whatever it takes to deliver an awesome product and experience to our users.

Want to work with us? We are hiring!

certified's Issues

URL http://martinottenwaelter.fr/2010/12/ruby19-and-the-ssl-error/ does not work

It returns:

404 Not Found
nginx/1.6.2

Thanks!

Don't bundle a .crt file in the gem

It's not a good idea to bundle the .crt file in the gem. You should rely on the system's certificates, especially on production machines on which security updates are installed regularly, so you're sure that the certificates list is always up to date.

Configurable path to ca file

Would be very nice if one could set the path to the ca file via an initializer!

Solved the issue but only for some domains

I was running into the infamous SSL error issue when opening pretty much any https url. After installing this gem things got better but am still getting the same error for some domains. E.g. if I type the following in the console:

url="https://itunes.apple.com"
f=open(url, :allow_redirections => :all)

yields:

OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed

Any idea how to solve this?
Thanks!

ca-bundle repo deprecated

Recommended bundle here https://curl.haxx.se/ca/cacert.pem

from page https://curl.haxx.se/docs/caextract.html

Correct post gem install message

certified-update is typed as certifed-update

IMPORTANT: Remember to use the included executable `certifed-update` regularly to keep your certificate bundle up to date.

How to do that?

License

Hi @stevegraham,

Can you add a license? MIT or whatever blows your hair back?

Thanks,
Marc

certified-update broken by Ruby 3.0

https://bugs.ruby-lang.org/issues/15893 deprecated (and finally removed in Ruby 3.0) the extension to Kernel.open by open-uri.

This breaks line 13 of certified-update.

A maximally backward compatible fix is:

-open(CERT_BUNDLE_URL) do |remote_file|
+URI(CERT_BUNDLE_URL).open do |remote_file|

Don't change cert store if the system one is good

System cert store is more likely to be kept current. It would be sensible to detect if the system is broken then only act at that point. Suggestions welcome.

cc @martoche

New point release to pick up the post install message typo fix. EOM