phusion / traveling-ruby

Self-contained Ruby binaries that can run on any Linux distribution and any macOS machine.

http://FooBarWidget.github.io/traveling-ruby

MIT License

2.1k stars 122 forks source link

get latest ca-bundle from cURL #102

Closed quinlanj closed 3 years ago

quinlanj commented 4 years ago

Problem

The CA certs that are bundled with traveling ruby are expired. This is problematic because we can no longer verify certificates in https requests.

Solution

Mozilla has public Certificate Authorities (CA) available in its source tree: https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt
cURL parses this certdata.txt and extracts CA Root Certificates into PEM format, and makes it publicly available on their website
Every time traveling ruby is released, bundle it with cURL's most up to date ca certs.

Assumes

we trust Mozilla and cURL

Verification that problem exists

# taking a look at the cert expiration dates
quins-mbp:shared quin$ openssl x509 -enddate -noout -in ca-bundle.crt
notAfter=Aug 17 22:00:00 2015 GMT

FooBarWidget commented 3 years ago

Thanks for notifying about this issue. I've upgraded the CA certs to that from CentOS 8.