Where openssl searches for default certificates?

2019-08-14 06:18发布

Today I faced a problem making https request with ruby under windows:

C:\Users\Yuri\_>type 2.rb
require 'net/http'
Net::HTTP.get URI 'https://google.com'

C:\Users\Yuri\_>2.rb
c:/Users/Yuri/programs/ruby-2.0.0-p353/lib/ruby/2.0.0/net/http.rb:918:in `connect': SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed (OpenSSL::SSL::SSLError)
        from c:/Users/Yuri/programs/ruby-2.0.0-p353/lib/ruby/2.0.0/net/http.rb:918:in `block in connect'
        from c:/Users/Yuri/programs/ruby-2.0.0-p353/lib/ruby/2.0.0/timeout.rb:52:in `timeout'
        from c:/Users/Yuri/programs/ruby-2.0.0-p353/lib/ruby/2.0.0/net/http.rb:918:in `connect'
        from c:/Users/Yuri/programs/ruby-2.0.0-p353/lib/ruby/2.0.0/net/http.rb:862:in `do_start'
        from c:/Users/Yuri/programs/ruby-2.0.0-p353/lib/ruby/2.0.0/net/http.rb:851:in `start'
        from c:/Users/Yuri/programs/ruby-2.0.0-p353/lib/ruby/2.0.0/net/http.rb:582:in `start'
        from c:/Users/Yuri/programs/ruby-2.0.0-p353/lib/ruby/2.0.0/net/http.rb:477:in `get_response'
        from c:/Users/Yuri/programs/ruby-2.0.0-p353/lib/ruby/2.0.0/net/http.rb:454:in `get'
        from C:/Users/Yuri/_/2.rb:2:in `<main>'

So I started investigating. As far as I can tell now, it's because windows version of ruby doesn't come bundled with ssl certificates. I decided to found out where it looks for them. procmon said that the script tries to open the following locations:

C:\Users\Luis\Code\openknapsack\knap-build\var\knapsack\software\x86-windows\openssl\1.0.0k\ssl\cert.pem
C:\Users\Luis\Code\openknapsack\knap-build\var\knapsack\software\x86-windows\openssl\1.0.0k\ssl\certs\

And it turned out this paths are in libeay32.dll:

c:\Users\Yuri\programs\ruby-2.0.0-p353\bin>strings libeay32.dll | grep openknapsack
OPENSSLDIR: "C:/Users/Luis/Code/openknapsack/knap-build/var/knapsack/software/x86-windows/openssl/1.0.0k/ssl"
C:/Users/Luis/Code/openknapsack/knap-build/var/knapsack/software/x86-windows/openssl/1.0.0k/lib/engines
C:/Users/Luis/Code/openknapsack/knap-build/var/knapsack/software/x86-windows/openssl/1.0.0k/ssl/private
C:/Users/Luis/Code/openknapsack/knap-build/var/knapsack/software/x86-windows/openssl/1.0.0k/ssl
C:/Users/Luis/Code/openknapsack/knap-build/var/knapsack/software/x86-windows/openssl/1.0.0k/ssl/certs
C:/Users/Luis/Code/openknapsack/knap-build/var/knapsack/software/x86-windows/openssl/1.0.0k/ssl/cert.pem

So I wonder if there are more sane ways to get this information, like with a small c program, or maybe from within the ruby? Supposedly, that's determined by the options with which libeay32.dll was built. Probably, one can determine it by inspecting the the source, if that's a good link for that. But that's way too difficult for me.

0条回答
登录 后发表回答