1

So I have this script:

#!/usr/bin/ruby

require 'net/https'
require 'open-uri'

puts "HTTPS Client for Ruby!"
puts "Enter the URL"
site = gets.chomp

url = URI.parse(site)

http = Net::HTTP.new(url.host,url.port)
http.use_ssl = true
http.verify_mode = OpenSSL::SSL::VERIFY_PEER

http.cert_store = OpenSSL::X509::Store.new
http.cert_store.set_default_paths
http.cert_store.add_file('/home/user/sec/certs/cacert.pem')

page = Net::HTTP.get(url)

puts page

It works fine. It's able to grab the html of the homepage of pretty much any http or https website. However, I have an HTTPS enabled webserver set up in a virtual machine which it doesn't work with. Before I enabled SSL on the webserver this script grabbed the html just fine. So my question is, why do I receive this error:

/usr/lib/ruby/2.1.0/net/http.rb:920:in `connect': SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed (OpenSSL::SSL::SSLError)
    from /usr/lib/ruby/2.1.0/net/http.rb:920:in `block in connect'
    from /usr/lib/ruby/2.1.0/timeout.rb:67:in `timeout'
    from /usr/lib/ruby/2.1.0/net/http.rb:920:in `connect'
    from /usr/lib/ruby/2.1.0/net/http.rb:863:in `do_start'
    from /usr/lib/ruby/2.1.0/net/http.rb:852:in `start'
    from /usr/lib/ruby/2.1.0/net/http.rb:583:in `start'
    from /usr/lib/ruby/2.1.0/net/http.rb:478:in `get_response'
    from /usr/lib/ruby/2.1.0/net/http.rb:455:in `get'
    from https_client.rb:20:in `<main>'

When running the script trying to grab the html of my web server? The path that I've specified has an actual certificate there.

1 Answer 1

-1

You get that error when the SSL certificate is self signed/not from a verified ssl provider.So assuming the website you are pulling from, is your own/you trust it and hasn't a verified certificate, change

http.verify_mode = OpenSSL::SSL::VERIFY_PEER

to

http.verify_mode = OpenSSL::SSL::VERIFY_NONE

same situation

3
  • This is the worst advice you could ever give. Turning on certificate verification defeats thew whole purpose and should not be done. Sep 9, 2014 at 13:55
  • @TanelSuurhans it would be except the OP stated that they are connecting to a HTTPS server the OP setup, and based on the error it means most likely the server they setup has a self signed certificate!
    – jtzero
    Sep 9, 2014 at 15:14
  • and if you can't trust your own server, who can you trust
    – jtzero
    Sep 9, 2014 at 15:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.