Ruby Net :: HTTP # ca_file kullanım dışı görünüyor.

Question

Sitemde ruby's Net :: HTTP tarafından doğrulanmayan bir StartCom ssl sertifikası kullanılıyor. Ruby'nin Net :: HTTP # ca_file öğesini ayarlıyorum, ancak yine de çalışmıyor.

irb(main):007:0> uri = URI('https://blog.a1ex.wang') 
=> #<URI::HTTPS https://blog.a1ex.wang> 
irb(main):008:0> h=Net::HTTP.new(uri.host,uri.port) 
=> #<Net::HTTP blog.a1ex.wang:443 open=false> 
irb(main):009:0> h.use_ssl=true 
=> true 
irb(main):010:0> h.ca_file="/home/alexwang/keys/blog/ca.pem" 
=> "/home/alexwang/keys/blog/ca.pem" 
irb(main):011:0> h.start 
OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=error: certificate verify failed 
    from /home/alexwang/.rvm/rubies/ruby-2.3.0/lib/ruby/2.3.0/net/http.rb:933:in `connect_nonblock' 
    from /home/alexwang/.rvm/rubies/ruby-2.3.0/lib/ruby/2.3.0/net/http.rb:933:in `connect' 
    from /home/alexwang/.rvm/rubies/ruby-2.3.0/lib/ruby/2.3.0/net/http.rb:863:in `do_start' 
    from /home/alexwang/.rvm/rubies/ruby-2.3.0/lib/ruby/2.3.0/net/http.rb:858:in `start' 
    from (irb):11 
    from /home/alexwang/.rvm/rubies/ruby-2.3.0/bin/irb:11:in `<main>' 
irb(main):012:0> 

Ama Kıvrık

SSL doğrulama Tamam görünüyor:

İşte benim kodudur.

> curl "https://blog.a1ex.wang" -I 
curl: (60) server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none 
More details here: http://curl.haxx.se/docs/sslcerts.html 

curl performs SSL certificate verification by default, using a "bundle" 
of Certificate Authority (CA) public keys (CA certs). If the default 
bundle file isn't adequate, you can specify an alternate file 
using the --cacert option. 
If this HTTPS server uses a certificate signed by a CA represented in 
the bundle, the certificate verification probably failed due to a 
problem with the certificate (it might be expired, or the name might 
not match the domain name in the URL). 
If you\'d like to turn off curl's verification of the certificate, use 
the -k (or --insecure) option. 
[16:53:12] alexwang@alexwang-surbuntu /home/alexwang (60)       
> curl "https://blog.a1ex.wang" --cacert keys/blog/ca.pem -I 
HTTP/1.1 200 OK 
Server: nginx/1.9.3 (Ubuntu) 
Date: Sun, 20 Mar 2016 08:53:18 GMT 
Content-Type: text/html; charset=UTF-8 
Connection: keep-alive 
Link: <https://blog.a1ex.wang/wp-json/>; rel="https://api.w.org/" 

Answer 1

Sen sadece kök sertifikası, ca.pem yılında zincirinde tüm sertifikaları olmalıdır. Siteniz zincirinde iki yetkilileri vardır:

CN = StartCom

• Sertifika Yetkilisi
• CN = StartCom Sınıf 1 DV Sunucu CA

ben ca.pem hem yetkilileri var sen eğer çalıştı.