Skip to content

ssl_verify_hostname var is ignored unless also specifying a ca_cert var #826

@lairen

Description

@lairen
  • Version of Ruby: 2.6.0
  • Version of Kafka: 1.1.1
  • Version of ruby-kafka: 1.0.0
Steps to reproduce
kafka = Kafka.new( seed_brokers: seed_brokers, ssl_client_cert: File.read(cert_path), ssl_client_cert_key: File.read(cert_key_path), ssl_verify_hostname: false ) kafka.topics 
Expected outcome

I expected the verify_hostname attr of the ssl_context to be set to false and passed to the OpenSSL gem with that value so that hostname is not verified and I can successfully connect to the broker.

Actual outcome

The verify_hostname attribute is ignored unless I explicitly pass in a ca_cert* parameter. Since it is defaulted to true in the OpenSSL gem, I'm getting these SSL errors:

ERROR: OpenSSL::SSL::SSLError - SSL_connect returned=1 errno=0 state=error: certificate verify failed (unspecified certificate verification error) 

I'm able to get around this by either downgraded to Ruby v2.3.3 (where that version of OpenSSL does not default verify_hostname) or by setting ssl_ca_certs_from_system: true in v2.6.0, which I don't need in my case since my client_cert is a combined cert. I can open up a PR to move the verify_hostname assignment out of this conditional but wanted to check if that was intentional and expected.

if ca_cert || ca_cert_file_path || ca_certs_from_system
store = OpenSSL::X509::Store.new
Array(ca_cert).each do |cert|
store.add_cert(OpenSSL::X509::Certificate.new(cert))
end
if ca_cert_file_path
store.add_file(ca_cert_file_path)
end
if ca_certs_from_system
store.set_default_paths
end
ssl_context.cert_store = store
ssl_context.verify_mode = OpenSSL::SSL::VERIFY_PEER
# Verify certificate hostname if supported (ruby >= 2.4.0)
ssl_context.verify_hostname = verify_hostname if ssl_context.respond_to?(:verify_hostname=)
end

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions