Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

can not use SSL_CERT_FILE to point to java keystore #70

Closed
mkristian opened this issue Sep 11, 2015 · 1 comment
Closed

can not use SSL_CERT_FILE to point to java keystore #70

mkristian opened this issue Sep 11, 2015 · 1 comment

Comments

@mkristian
Copy link
Member 

SSL_CERT_FILE=/Library/Java/JavaVirtualMachines/jdk1.8.0_51.jdk/Contents/Home/jre/lib/security/cacerts bin/jruby -ropen-uri -e "p open('https://wikipedia.org')" 
OpenSSL::SSL::SSLError: certificate verify failed
             connect at org/jruby/ext/openssl/SSLSocket.java:210
    block in connect at /Users/cmeier/projects/active/jruby/lib/ruby/stdlib/net/http.rb:927
             timeout at org/jruby/ext/timeout/Timeout.java:128
             connect at /Users/cmeier/projects/active/jruby/lib/ruby/stdlib/net/http.rb:927
            do_start at /Users/cmeier/projects/active/jruby/lib/ruby/stdlib/net/http.rb:867
               start at /Users/cmeier/projects/active/jruby/lib/ruby/stdlib/net/http.rb:856
           open_http at /Users/cmeier/projects/active/jruby/lib/ruby/stdlib/open-uri.rb:318
         buffer_open at /Users/cmeier/projects/active/jruby/lib/ruby/stdlib/open-uri.rb:736
  block in open_loop at /Users/cmeier/projects/active/jruby/lib/ruby/stdlib/open-uri.rb:211
               catch at org/jruby/RubyKernel.java:1098
           open_loop at /Users/cmeier/projects/active/jruby/lib/ruby/stdlib/open-uri.rb:209
            open_uri at /Users/cmeier/projects/active/jruby/lib/ruby/stdlib/open-uri.rb:150
                open at /Users/cmeier/projects/active/jruby/lib/ruby/stdlib/open-uri.rb:716
                open at /Users/cmeier/projects/active/jruby/lib/ruby/stdlib/open-uri.rb:34
               <top> at -e:1

the same works without the SSL_CERT_FILE

$ bin/jruby -ropen-uri -e "p open('https://wikipedia.org')" 
#<Tempfile:/var/folders/rr/yzrd89qn0_58wrr37mtprb4x33vz1n/T/open-uri20150911-22766-1o2bqw8>

not sure if this is a bug since this is JRuby specific as java keystores are just for java.

BUT if the code which "loads" the default location and the custom location with via SSL_CERT_FILE would be the SAME. then you do indirectly test the default locations (there is no way to test the default cert files otherwise as they depend on the OS and system setup)

this would be the only way to get tests for #49 implemented
mkristian added a commit that referenced this issue Sep 11, 2015
@mkristian
keep in line with MRI if possible
ad93636 
keep the default x509 certs and directories in line with MRI, only if
they do not exists fallback on cacerts from the java.home/lib/security/cacerts

fixes #49, #70 and keeps the idea of b914091

Sponsored by Lookout Inc.
@mkristian
Copy link
Member Author

fix with ad93636

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@mkristian