eventmachine/eventmachine — pull request #334 by burke (2012-05-24 21:30:50+00:00)
Title: SSL Peer Verification and other SSL improvements

The commit log is quite descriptive, but here are some highlights:

* Includes @miketheiron's pull #84: private key passwords and custom CA files.
* Perform real SSL verification internally:
* Verify that a cert is signed by a trusted CA
* If a `:hostname` argument is passed to `start_tls`, verify that the Subject CN matches this value.
* Add a new `preverify_ok` parameter to `ssl_verify_peer`:
* true or false, this indicates whether the C-level certificate verification passed or failed.
* By default, `ssl_verify_peer` now returns preverify_ok, ie. the openssl verification result. This is normally the right thing to do: this method no longer requires overriding for security.
* Overriding methods can choose to ignore `preverify_ok` and determine validity on their own based on the still-passed `cert` parameter or any other criteria.
* C code checks the method arity so existing one-parameter `ssl_verify_peer` definitions will continue to work with no modifications.
* Bundled a default CA file, used if no :ca_file is passed to `start_tls`.
* Updated docs and tests.

Very open to discussion on this. Feel free to hit me up on email or gtalk at burke@burkelibbey.org.