OpenSSL::SSL::SSLError with SOAP4r and the Rubyforge gem

Manfred Stienstra, 14 Mar 2007, 10:25 in ruby on rails, last updated 08 Jun 2007, 11:35 (edit).

If you’ve installed the Rubyforge gem, which is a dependency of just about every gem in the wild through Hoe, then you might have see the OpenSSL::SSL::SSLError when trying to connect to a server over SSL. This is caused by http_access2 because it refuses to connect with SSL without verifying the certificates.

The problem is a little bit tricky because SOAP4r abstracts you away from http_access2 and that makes it hard to set the proper configuration on the HTTP client. Fortunately SOAP4r has a way to configure it’s subsystem.

Let’s assume that you’ve defined a SOAP::RPC::Driver somewhere.

class WebrApi < ::SOAP::RPC::Driver
  DefaultEndpointUrl = "https://webr.com/api"
  [snip]
end

There are two ways of making the error go away, the first is to tell http_access2 to stop verifying certificates and just get on with the connection.

proxy = WebrApi.new
proxy.options['protocol.http.ssl_config.verify_mode'] = OpenSSL::SSL::VERIFY_NONE

This is not recommended because one of the ideas behind SSL is that you can always verify that you’re talking to the correct server. If you want to keep this feature you will have to tell http_access2 which certificates to use.

proxy = WebrApi.new
client.options['protocol.http.ssl_config.verify_mode'] = OpenSSL::SSL::VERIFY_PEER
client.options['protocol.http.ssl_config.ca_file'] = '/etc/ssl/certs/certification_authority.crt'
client.options['protocol.http.ssl_config.client_cert'] = '/etc/ssl/certs/client.cert'
client.options['protocol.http.ssl_config.client_key'] = '/etc/ssl/certs/client.key'

You can find more advanced configuration examples in the SOAP4r source in sample/soap/ssl.

Comments

  1. Brian 212 days later: (delete)

    Which Rubyforge gem?? Which gem should one install to make a webservice call using openssh....

  2. Manfred Stienstra 212 days later: (delete)

    I was talking about the gem with the name 'Rubyforge', it's a bit confusing. I assume you mean SOAP when you say 'webservice' and SSL when you say 'openssh'. You don't need to install any gem to do SOAP over SSL, OpenSSL is bundled with Ruby (if you install Ruby correctly). Furthermore, you can't force a client to use SSL to reach an endpoint, the endpoint is either on SSL or isn't.

Add your comment

In order to fight spam on this blog, posting comments from a browser without javascript is currently not supported.