OpenSSL::SSL::SSLError: Ruby client's server ca certificate does not work while it worked with curl

Question

I got certificate from customer to connect with their VPN, but it does not work with ruby code while it worked with curl command. Curl command is as follows:

curl --cacert cert.cer -d '{"acb": 123 }' -H 'Content-Type: application/json' 'https://demo.com'

In ruby, I am trying to do the following to connect the client APIs provided to us for transactions.

require 'net/http'
require 'json'
require 'uri'

full_url = "https://demo.com"
uri = URI.parse(full_url)

data = { "acb": 123 }
headers = { 'Content-Type' => "application/json" }

http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true

raw = File.read("path_to_the_certificate")
http.cert = OpenSSL::X509::Certificate.new(raw)

request = Net::HTTP::Post.new(uri.request_uri, headers)
request.body = data.to_json

response = http.request(request)

puts response.code
puts response.body

We also tried to pass our server's certificate as follows, but that doesn't work either

http.ca_path='/etc/pki/tls/certs'
http.ca_file='/etc/pki/tls/certs/cert.cer'
http.cert = OpenSSL::X509::Certificate.new(File.read("/path/client.crt"))
http.key = OpenSSL::PKey::RSA.new(File.read("/path/client.key"))

Getting the following error while

OpenSSL::SSL::SSLError (SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate))

Answer 1

I think the issue with their self-signed certificate. It fails verification. However, you can manually disable it with

http.verify_mode = OpenSSL::SSL::VERIFY_NONE

verify_mode[RW]

Sets the flags for server the certification verification at beginning of SSL/TLS session.

OpenSSL::SSL::VERIFY_NONE or OpenSSL::SSL::VERIFY_PEER are acceptable.

from https://ruby-doc.org/stdlib-2.7.0/libdoc/net/http/rdoc/Net/HTTP.html

I tried to replicate it locally and it worked with this fix.

Answer 2

It should be that the vpn certificate is self-signed, you need to specify your own cacert, so you specify cacert file as the file used by the curl above, not the cacert file that comes with the system

add this line:

http.ca_file = "cacert filename" 

Like this:

require 'net/http'
require 'json'
require 'uri'

full_url = "https://localhost/test.html"
uri = URI.parse(full_url)

data = { "acb": 123 }
headers = { 'Content-Type' => "application/json" }

http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true

# You need to specify the cacert file used for curl above (filename: cert.cer)
http.ca_file = "/root/myca/cacert.crt"

request = Net::HTTP::Post.new(uri.request_uri, headers)
request.body = data.to_json

response = http.request(request)

puts response.code
puts response.body

Answer 3

you should add your certificate in .pem format to (depending on the version) either:

C:\Ruby{version number}{-x64 - if 64 bit operating system}\ssl

eg C:\Ruby25-x64\ssl

or to

C:\Ruby{version number}{-x64 - if 64 bit operating system}\lib\ruby{version number}\rubygems\ssl_certs{your cn}

eg C:\Ruby25-x64\lib\ruby\2.5.0\rubygems\ssl_certs\client.cn

and then in the C:\Ruby{The version number}{-x64 - If it's a 64-bit operating system}\ssl\certs run the c_rehash.r script

Answer 4

For Apps using PayPal::SDK.configure(...)

PayPal::SDK.configure(
  mode: ...,
  client_id: ...,
  client_secret: ...,

  # Deliberately set ca_file to nil so the system's Cert Authority is used,
  # instead of the bundled paypal.crt file which is out-of-date due to:
  # https://www.paypal.com/va/smarthelp/article/discontinue-use-of-verisign-g5-root-certificates-ts2240
  ssl_options: { ca_file: nil }
)

For apps using a YAML config file

ssl_options:
  ca_file: null