From: Mike Papper <bodarotech@...>
Date: 2010-08-25T15:12:59+09:00
Subject: Re: HTTPClient Suddenly Fails - Cannot Verify Certificate File

Heres is a test I ran from the rails console to verify that the issue is 
from my local machine, not the endpoint:

--------------------------

require 'httpclient'
uri='https://www.rsa.com'
=> "https://www.rsa.com"
>> client = HTTPClient.new()
=> #<HTTPClient:0x2b2ff0882a48 
@www_auth=#<HTTPClient::WWWAuth:0x2b2ff08829a8 
@authenticator=[#<HTTPClient::NegotiateAuth:0x2b2ff0882728 
@scheme="Negotiate", @challenge={}, @ntlm_opt={:ntlmv2=>true}, 
@auth_default=nil, @auth={}>, 
#<HTTPClient::SSPINegotiateAuth:0x2b2ff0882688 @scheme="Negotiate", 
@challenge={}>, #<HTTPClient::DigestAuth:0x2b2ff08827c8 
@scheme="Digest", @challenge={}, @nonce_count=0, @auth={}>, 
#<HTTPClient::BasicAuth:0x2b2ff08827f0 @scheme="Basic", @cred=nil, 
@challengeable={}, @auth={}>], 
@negotiate_auth=#<HTTPClient::NegotiateAuth:0x2b2ff0882728 
@scheme="Negotiate", @challenge={}, @ntlm_opt={:ntlmv2=>true}, 
@auth_default=nil, @auth={}>, 
@basic_auth=#<HTTPClient::BasicAuth:0x2b2ff08827f0 @scheme="Basic", 
@cred=nil, @challengeable={}, @auth={}>, 
@sspi_negotiate_auth=#<HTTPClient::SSPINegotiateAuth:0x2b2ff0882688 
@scheme="Negotiate", @challenge={}>, 
@digest_auth=#<HTTPClient::DigestAuth:0x2b2ff08827c8 @scheme="Digest", 
@challenge={}, @nonce_count=0, @auth={}>>, 
@ssl_config=#<HTTPClient::SSLConfig:0x2b2ff0881a08 
@ciphers="ALL:!ADH:!LOW:!EXP:!MD5:+SSLv2:@STRENGTH", 
@cert_store=#<OpenSSL::X509::Store:0x2b2ff08814e0>, @verify_depth=nil, 
@timeout=nil, @client_key=nil, @options=16781303, 
@client=#<HTTPClient:0x2b2ff0882a48 ...>, @dest=nil, @client_cert=nil, 
@verify_callback=nil, @client_ca=nil, @verify_mode=3>, 
@session_manager=#<HTTPClient::SessionManager:0x2b2ff0881a58 
@connect_retry=1, @sess_pool_mutex=#<Mutex:0x2b2ff08815f8>, 
@protocol_version=nil, @from=nil, @read_block_size=16384, 
@ssl_config=#<HTTPClient::SSLConfig:0x2b2ff0881a08 
@ciphers="ALL:!ADH:!LOW:!EXP:!MD5:+SSLv2:@STRENGTH", 
@cert_store=#<OpenSSL::X509::Store:0x2b2ff08814e0>, @verify_depth=nil, 
@timeout=nil, @client_key=nil, @options=16781303, 
@client=#<HTTPClient:0x2b2ff0882a48 ...>, @dest=nil, @client_cert=nil, 
@verify_callback=nil, @client_ca=nil, @verify_mode=3>, 
@connect_timeout=60, @sess_pool=[], @agent_name=nil, 
@receive_timeout=60, @client=#<HTTPClient:0x2b2ff0882a48 ...>, 
@chunk_size=4096, @proxy=nil, @test_loopback_http_response=[], 
@debug_dev=nil, @send_timeout=120, @socket_sync=true, 
@protocol_retry_count=5>, @no_proxy=nil, 
@redirect_uri_callback=#<Method: 
HTTPClient#default_redirect_uri_callback>, 
@proxy_auth=#<HTTPClient::ProxyAuth:0x2b2ff0882840 
@authenticator=[#<HTTPClient::NegotiateAuth:0x2b2ff0882318 
@scheme="Negotiate", @challenge={}, @ntlm_opt={:ntlmv2=>true}, 
@auth_default=nil, @auth={}>, 
#<HTTPClient::SSPINegotiateAuth:0x2b2ff0881f08 @scheme="Negotiate", 
@challenge={}>, #<HTTPClient::BasicAuth:0x2b2ff0882340 @scheme="Basic", 
@cred=nil, @challengeable={}, @auth={}>], 
@negotiate_auth=#<HTTPClient::NegotiateAuth:0x2b2ff0882318 
@scheme="Negotiate", @challenge={}, @ntlm_opt={:ntlmv2=>true}, 
@auth_default=nil, @auth={}>, 
@basic_auth=#<HTTPClient::BasicAuth:0x2b2ff0882340 @scheme="Basic", 
@cred=nil, @challengeable={}, @auth={}>, 
@sspi_negotiate_auth=#<HTTPClient::SSPINegotiateAuth:0x2b2ff0881f08 
@scheme="Negotiate", @challenge={}>>, @proxy=nil, @debug_dev=nil, 
@cookie_manager=#<WebAgent::CookieManager:0x2b2ff08815d0 @cookies=[], 
@accept_domains=[], @reject_domains=[], @is_saved=true, 
@netscape_rule=false, @cookies_file=nil>, @test_loopback_response=[], 
@follow_redirect_count=10, 
@request_filter=[#<HTTPClient::ProxyAuth:0x2b2ff0882840 
@authenticator=[#<HTTPClient::NegotiateAuth:0x2b2ff0882318 
@scheme="Negotiate", @challenge={}, @ntlm_opt={:ntlmv2=>true}, 
@auth_default=nil, @auth={}>, 
#<HTTPClient::SSPINegotiateAuth:0x2b2ff0881f08 @scheme="Negotiate", 
@challenge={}>, #<HTTPClient::BasicAuth:0x2b2ff0882340 @scheme="Basic", 
@cred=nil, @challengeable={}, @auth={}>], 
@negotiate_auth=#<HTTPClient::NegotiateAuth:0x2b2ff0882318 
@scheme="Negotiate", @challenge={}, @ntlm_opt={:ntlmv2=>true}, 
@auth_default=nil, @auth={}>, 
@basic_auth=#<HTTPClient::BasicAuth:0x2b2ff0882340 @scheme="Basic", 
@cred=nil, @challengeable={}, @auth={}>, 
@sspi_negotiate_auth=#<HTTPClient::SSPINegotiateAuth:0x2b2ff0881f08 
@scheme="Negotiate", @challenge={}>>, 
#<HTTPClient::WWWAuth:0x2b2ff08829a8 
@authenticator=[#<HTTPClient::NegotiateAuth:0x2b2ff0882728 
@scheme="Negotiate", @challenge={}, @ntlm_opt={:ntlmv2=>true}, 
@auth_default=nil, @auth={}>, 
#<HTTPClient::SSPINegotiateAuth:0x2b2ff0882688 @scheme="Negotiate", 
@challenge={}>, #<HTTPClient::DigestAuth:0x2b2ff08827c8 
@scheme="Digest", @challenge={}, @nonce_count=0, @auth={}>, 
#<HTTPClient::BasicAuth:0x2b2ff08827f0 @scheme="Basic", @cred=nil, 
@challengeable={}, @auth={}>], 
@negotiate_auth=#<HTTPClient::NegotiateAuth:0x2b2ff0882728 
@scheme="Negotiate", @challenge={}, @ntlm_opt={:ntlmv2=>true}, 
@auth_default=nil, @auth={}>, 
@basic_auth=#<HTTPClient::BasicAuth:0x2b2ff08827f0 @scheme="Basic", 
@cred=nil, @challengeable={}, @auth={}>, 
@sspi_negotiate_auth=#<HTTPClient::SSPINegotiateAuth:0x2b2ff0882688 
@scheme="Negotiate", @challenge={}>, 
@digest_auth=#<HTTPClient::DigestAuth:0x2b2ff08827c8 @scheme="Digest", 
@challenge={}, @nonce_count=0, @auth={}>>]>
>> client.get(uri).content
at depth 3 - 20: unable to get local issuer certificate
OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=SSLv3 read 
server certificate B: certificate verify failed
        from 
/usr/local/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient/session.rb:247:in 
`connect'
        from 
/usr/local/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient/session.rb:247:in 
`ssl_connect'
        from 
/usr/local/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient/session.rb:639:in 
`connect'
        from 
/usr/local/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient/timeout.rb:128:in 
`timeout'
        from 
/usr/local/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient/session.rb:631:in 
`connect'
        from 
/usr/local/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient/session.rb:522:in 
`query'
        from 
/usr/local/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient/session.rb:147:in 
`query'
        from 
/usr/local/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient.rb:953:in 
`do_get_block'
        from 
/usr/local/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient.rb:765:in 
`do_request'
        from 
/usr/local/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient.rb:848:in 
`protect_keep_alive_disconnected'
        from 
/usr/local/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient.rb:764:in 
`do_request'
        from 
/usr/local/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient.rb:666:in 
`request'
        from 
/usr/local/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient.rb:591:in 
`get'
        from (irb):7

The last error response mentions "local issuer certificate" which leads 
me to believe the issue is opening the cacerts.p7s file.

Incidently, adding in:
client.ssl_config.set_trust_ca('/usr/local/lib/ruby/gems/1.8/gems/httpclient-2.1.5.2/lib/httpclient/cacert.p7s')

has no effect. I also tried calling client.ssl_config.set_trust_ca and 
pointing to "some other .pem file that sitting on the linux box 
somewhere" but that made no difference either.

Mike
-- 
Posted via http://www.ruby-forum.com/.