RUBY-3694 Gracefully handle the case where the issuer can't be found #2946
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There was a problem hiding this comment.
Pull Request Overview
This PR improves OCSP (Online Certificate Status Protocol) verification by gracefully handling cases where the issuer certificate cannot be found in the certificate chain. The change adds proper error handling with a warning message and early return, following patterns established in other MongoDB drivers like Python.
- Adds the
Loggablemodule to enable warning logging - Implements graceful handling when issuer certificate is not found during OCSP verification
- Refactors the early return condition for better readability
alexbevi
approved these changes
Aug 8, 2025
jamis
added a commit
to jamis/mongo-ruby-driver
that referenced
this pull request
Aug 8, 2025
jamis
added a commit
that referenced
this pull request
Aug 19, 2025
* RUBY-3694 Use correct CA when verifying OCSP endpoint (#2944) * use the next cert in the chain as the CA when verifying OCSP * don't assume the issuer is at a particular position in the chain * Fix incorrect method description * https for submodules * fix submodule syntax * update test configuration * bump drivers-evergreen-tools for DB version lookups * allow prepare_server to compute the distro in the format it needs * more evergreen config tweaks * more test tweaks * fix broken resolver specs * don't try to use mock_dns on ruby 2.7 * make sure and definie the minimum_mri_version constraint * use https to clone git repos * maybe we need to skip sooner to avoid the around hooks... * Gracefully handle the case where the issuer can't be found (#2946) * no need to test against latest; 2.20.x only supports up to 7.0
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
One more issue related to the OCSP stuff -- just a warning if the issuer certificate cannot be found. Copilot caught the lack of this check, and upon checking other drivers, Python (at least) takes the "warn and return" approach.