heroku/heroku — Issue #236: SSL verify issues on Debian Lenny
Author: tmm1
Created: 2012-02-15 02:38:47+00:00
State: open

On Debian Lenny, with openssl 0.9.8g, ssl verification using the bundled `data/cacert.pem` fails. Using the system's `ca-certificates.crt` works fine:

```
$ dpkg -l libssl0.9.8
ii libssl0.9.8 0.9.8g-15+lenny16 SSL shared libraries

$ ruby -rubygems -I lib -e'
require "bundler/setup";
require "rest-client";
RestClient::Resource.new(
"https://api.heroku.com",
:verify_ssl => OpenSSL::SSL::VERIFY_PEER,
:ssl_ca_file => "/usr/lib/ssl/certs/ca-certificates.crt"
).get '

$ ruby -rubygems -I lib -e'
require "bundler/setup";
require "rest-client";
RestClient::Resource.new(
"https://api.heroku.com",
:verify_ssl => OpenSSL::SSL::VERIFY_PEER,
:ssl_ca_file => "gems/ruby/1.8/gems/heroku-2.5.2/data/cacert.pem"
).get '
gems/rest-client-1.6.7/lib/restclient/request.rb:151:in `transmit': SSL Verification failed -- Preverify: false, Error: unable to get local issuer certificate (20) (RestClient::SSLCertificateNotVerified)
from /usr/lib/ruby/1.8/net/http.rb:586:in `call'
from /usr/lib/ruby/1.8/net/http.rb:586:in `connect'
from /usr/lib/ruby/1.8/net/http.rb:586:in `connect'
from /usr/lib/ruby/1.8/net/http.rb:553:in `do_start'
from /usr/lib/ruby/1.8/net/http.rb:542:in `start'
from gems/rest-client-1.6.7/lib/restclient/request.rb:172:in `transmit'
from gems/rest-client-1.6.7/lib/restclient/request.rb:64:in `execute'
from gems/rest-client-1.6.7/lib/restclient/request.rb:33:in `execute'
from gems/rest-client-1.6.7/lib/restclient/resource.rb:54:in `get'
from -e:1
```

Upgrading to `0.9.8o` from backports also fixes the issue:

```
$ dpkg -l libssl0.9.8
ii libssl0.9.8 0.9.8o-4~bpo50+1 SSL shared libraries

$ ruby -rubygems -I lib -e'
require "bundler/setup";
require "rest-client";
RestClient::Resource.new(
"https://api.heroku.com",
:verify_ssl => OpenSSL::SSL::VERIFY_PEER,
:ssl_ca_file => "/usr/lib/ssl/certs/ca-certificates.crt"
).get '

$ ruby -rubygems -I lib -e'
require "bundler/setup";
require "rest-client";
RestClient::Resource.new(
"https://api.heroku.com",
:verify_ssl => OpenSSL::SSL::VERIFY_PEER,
:ssl_ca_file => "gems/ruby/1.8/gems/heroku-2.5.2/data/cacert.pem"
).get '
```