SSL issue with legacy Rubies and 2.7.11

[JonRowe]

Hello!

Thank you for your hard work maintaining Rubygems, it is especially appreciated you've taken the time to back port new SSL certs to older versions of Rubygems, e.g. 2.7.11

I'm trying to use this to build some CI for legacy (pre 2.0) Rubies as RSpec still supports these until we release 4.0.0 (and we'd like the sanity check for some of our extension gems and transition work toward that, where we will be changing to a minimum of 2.3 supported)

Using 2.7.11 to install the last Bundler 1.x release (1.17.3) results in this error:

 Unable to download data from https://rubygems.org/ - hostname was not match with the server certificate (https://api.rubygems.org/specs.4.8.gz)

Yet strangely some older versions of Rubygems work fine, e.g. the defaults for 1.9.3 and 2.0 can install bundler and carry on

Is there an intermediate certificate required to use the new certs?

[deivid-rodriguez]

Hello! 👋

Unfortunately I have no idea about what the problem could be here, sorry. Can you stick to that older rubygems that installs bundler fine? 😬

[tooss367]

Hello! 👋

Unfortunately I have no idea about what the problem could be here, sorry. Can you stick to that older rubygems that installs bundler fine? 😬

#4228 (comment)

[JonRowe]

Ok so I've been able to update the newer (but still EOL I know) Rubies to use the latest version, which makes me suspect this is an open ssl issue. (As manually downloading gems works fine, so the docker images their self must be able to validate Rubygems certs).

However I cannot disable SSL verification via the gemrc trick, nor does bundler config seem to respect the flag, which may be related to #4192).

I've run the (slightly edited to ignore an non existent RUBY_REVISION) Ruby SSL checking script mentioned here:
https://bundler.io/guides/rubygems_tls_ssl_troubleshooting_guide.html#automated-ssl-check

And it doesn't mention anything other than its unable to match the hostname?

[JonRowe]

Strangely JRuby 1.7 works fine, but if I run it in 1.8 mode that breaks, which makes me feel very much like its emulating something, if the TLS version was the issue would the script highlight that?

[tooss367]

Okay do I was just told to check this out but idk what your talking about.

…

On Thu, Jan 7, 2021, 3:50 PM Jon Rowe ***@***.***> wrote: Strangely JRuby 1.7 works fine, but if I run it in 1.8 mode that breaks, which makes me feel very much like its emulating something, if the TLS version was the issue would the script highlight that? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#4228 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ASMDBIJNYN7C4LKDGOSQBKTSYY3DLANCNFSM4VRGL2NA> .

[isikyus]

I believe I'm seeing the same issue as @JonRowe .
Output from https://github.com/rubygems/ruby-ssl-check/blob/master/check.rb :

$ ruby ~/Downloads/check.rb
Here's your Ruby and OpenSSL environment:

Ruby:           [old EOL ruby]
RubyGems:       2.0.17
Bundler:        1.17.3
Compiled with:  OpenSSL 1.0.2t  10 Sep 2019
SSL_CERT_FILE:  /home/linuxbrew/.linuxbrew/etc/openssl/cert.pem
SSL_CERT_DIR:   /home/linuxbrew/.linuxbrew/etc/openssl/certs

With that out of the way, let's see if you can connect to rubygems.org...

Bundler connection to rubygems.org:       failed  ❌  (hostname was not match with the server certificate)
RubyGems connection to rubygems.org:      failed  ❌  (hostname was not match with the server certificate (https://rubygems.org))
Ruby net/http connection to rubygems.org: failed  ❌

Unfortunately, this Ruby can't connect to rubygems.org. 😡
Your Ruby can't connect to rubygems.org because you are missing the certificate files OpenSSL needs to verify you are connecting to the genuine rubygems.org servers.

The source of that script in turn recommends https://github.com/mislav/ssl-tools/blob/8b3dec4/doctor.rb, which tells me this:

$ ruby ~/Downloads/doctor.rb rubygems.org
/home/edward/.rvm/rubies/[old EOL ruby]/bin/ruby ([old EOL ruby])
OpenSSL 1.0.2t  10 Sep 2019: /home/linuxbrew/.linuxbrew/etc/openssl
SSL_CERT_DIR=""
SSL_CERT_FILE=""

HEAD https://rubygems.org:443
OpenSSL::SSL::SSLError: hostname was not match with the server certificate

Possible causes:
  `/home/linuxbrew/.linuxbrew/etc/openssl/certs/' is empty

It looks like /home/linuxbrew/.linuxbrew/etc/openssl/certs/ doesn't exist at all on my machine — I suspect I may have messed up reinstalling Ruby (or it should be loading SSL certificates from somewhere else).

[isikyus]

And it doesn't mention anything other than its unable to match the hostname?

I've traced the request in Wireshark and it looks like the hostname actually is wrong.
RubyGems isn't sending the SNI extension, so Fastly isn't returning the correct rubygems.org certificate.

By contrast, CURL (which works) is sending a server_name extension in the client handshake.

[isikyus]

It appears my issue is actually in net/https or another core library, not rubygems. The doctor.rb script doesn't use RubyGems, and it reproduces the failure in the old Ruby I'm using, but not in 2.6.3.

Both Rubies are built against the same OpenSSL:

$ ruby ~/Downloads/doctor.rb rubygems.org:443
/home/edward/.rvm/rubies/ruby-2.6.3/bin/ruby (2.6.3-p62)
OpenSSL 1.0.1f 6 Jan 2014: /usr/lib/ssl
SSL_CERT_DIR=""
SSL_CERT_FILE=""

HEAD https://rubygems.org:443
OK

$ ruby ~/Downloads/doctor.rb rubygems.org:443
/home/edwaredward@meta-110417-a:~/.../websited/.rvm/rubies/[old EOL Ruby]/bin/ruby ([old EOL Ruby])
OpenSSL 1.0.1f 6 Jan 2014: /usr/lib/ssl
SSL_CERT_DIR=""
SSL_CERT_FILE=""

HEAD https://rubygems.org:443
OpenSSL::SSL::SSLError: hostname was not match with the server certificate

Possible causes:
  `/usr/lib/ssl/cert.pem' does not exist

[MSP-Greg]

Ruby's SSL uses either the cert file shown in:

SSL_CERT_FILE:  /home/linuxbrew/.linuxbrew/etc/openssl/cert.pem

or it will load individual files from:

SSL_CERT_DIR:   /home/linuxbrew/.linuxbrew/etc/openssl/certs

I don't know if there's any easy way to update either. Windows Ruby builds have one bundled with them, but they're 7zip (.7z) files...

[deivid-rodriguez]

Nice investigation @isikyus! I love how you redacted your EOL'd ruby version 🤣.

Maybe you could try updating net/http. This library is gemified and it doesn't support your ruby version, but I'm not sure if it was bumped due to a real incompatibility or just for maintenance convenience 🤷‍♂️.

[deivid-rodriguez]

I found this link that might help you track this down: drbrain/net-http-persistent#62. From there you can get to the ruby-core issue and the patch that got eventually merged to net/http.

[isikyus]

Maybe you could try updating net/http.

I may try that later on, thanks @deivid-rodriguez ; for the moment I've got it working through a proxy.
In the long run the plan is to use a current Ruby and avoid the issue entirely 😄