STARTTLS与Ruby和OpenSSL的连接

Question

Using openssl s_client on the command line I am able to establish a comection to a POP3 server which requires STARTTLS.

openssl s_client -connect pop3.example.com:110 -starttls pop3

How can I accomplish the same (especially the -starttls pop part) utilizing Ruby's OpenSSL library:

tcp_socket = TCPSocket.new host, port
ssl_context = OpenSSL::SSL::SSLContext.new
ssl_client = OpenSSL::SSL::SSLSocket.new tcp_socket, ssl_context
ssl_client.connect

Answer 1

The POP3 specification states that you need to send STLS in order to initiate the TLS handshake. Therefore you should send STLS on the unencrypted socket first, and after that you should be able to call connect on the OpenSSL layer, which will then perform the actual handshake.

If you call connect before sending STLS , the server won't know what is going on, and will interpret it as garbage input.

Working example:

tcp = TCPSocket.new(host, port)

puts tcp.gets
tcp.puts 'STLS'
puts tcp.gets

ssl_context = OpenSSL::SSL::SSLContext.new
ssl_client  = OpenSSL::SSL::SSLSocket.new(tcp, ssl_context)

ssl_client.connect
puts ssl_client.state

ssl_client.puts "NOOP"
puts ssl_client.gets

Output:

+OK POP3 ready <2067986403.1526483285@....>
+OK
SSLOK
+OK