search

jamesgolick / always_verify_ssl_certificates

Ruby's net/http is setup to never verify SSL certificates by default. Most ruby libraries do the same. That means that you're not verifying the identity of the server you're communicating with and are therefore exposed to man in the middle attacks. This gem monkey-patches net/http to force certificate verification and make turning it off impossible.
MIT License
97 stars 16 forks source link

Think I did it #1

Closed cmer closed 13 years ago

cmer commented 13 years ago

Seems to work on Ubuntu and OS X. It's just weird that the OS X directory is empty, but it works... go figure.

Let me know if it works for you... Couldn't test on Red Hat.

jamesgolick commented 13 years ago

So the only problem with this is that the OSX path doesn't actually contain any certificates. What kind of testing did you do?

cmer commented 13 years ago

I know, which is odd. But it worked for me. I was able to connect to https://github.com and other https just fine without any errors... Am I missing something?

require 'always_verify_ssl_certificates'
url = URI.parse("https://github.com/")
request = Net::HTTP::Get.new(url.path)
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
response = http.start {|http| http.request(request) }
jamesgolick commented 13 years ago

Yeah, but have you tried connecting to a server that's using a self-signed certificate? I'm wondering whether an empty ca_path means that it'll just verify everything. If that's the case, then this gem should check that too.

cmer commented 13 years ago

I didn't try that. I don't have access to such a thing.

The path for OS X seems to be right, but it's definitely odd. See http://cheat.errtheblog.com/s/openssl/. I just found this however:

Mac OSX 10.5 (Leopard) onwards

It is no longer possible to import certificates into Leopard on the command line. Instead, you need to use the Keychain Access application (ask finder for it).

at: http://gagravarr.org/writing/openssl-certs/others.shtml

jamesgolick commented 13 years ago

This was fixed by ef5be