There is a lot of details here: http://www.rubyinside.com/how-to-cure-nethttps-risky-default-https-behavior-4010.html

Not sure why we can't have our client verify the SSL certificate.