module Gems::CertificateOptions

The certificates TLS is verified with and presented by, mixed into the configuration and the connection

A host whose certificate Ruby’s OpenSSL does not already trust, such as a private gem server with one of its own, is reached by naming that certificate here rather than by turning verification off: there is no option for that, so a request of this library is always verified. A host that asks the client for a certificate of its own is given {#client_cert} and {#client_key}.

The paths are checked where they are assigned, as a host and a proxy URL are (see {URLValidation}), so that a path that names nothing is reported as the assignment that was wrong instead of as the TLS failure of the next request. The value that is rejected is left as it was.

The configuration uses these as options; the connection also hands them to the HTTP client it opens.

@api private

Constants

SETTINGS: The names of the settings, which are the options of {Client} and of the {Gems} module that name certificates

Attributes

ca_file [R]

The path of a file of certificates TLS is verified with

The certificates in the file are trusted alongside the ones OpenSSL already trusts.

@api private @return [String, nil] the path of the file, or nil to verify with the certificates OpenSSL trusts @example Get the CA file

connection.ca_file

ca_path [R]

The path of a directory of certificates TLS is verified with

The directory holds the certificates under the hashed names ‘openssl rehash` gives them.

@api private @return [String, nil] the path of the directory, or nil to verify with the certificates OpenSSL trusts @example Get the CA path

connection.ca_path

cert_store [RW]

The store of certificates TLS is verified with

A store of your own replaces the certificates OpenSSL trusts, where {#ca_file} and {#ca_path} add to them.

@api private @return [OpenSSL::X509::Store, nil] the store, or nil to verify with the certificates OpenSSL trusts @example Get or set the certificate store

connection.cert_store = OpenSSL::X509::Store.new

client_cert [RW]

The certificate presented to a host that asks the client for one

@api private @return [OpenSSL::X509::Certificate, nil] the certificate, or nil to present none @example Get or set the client certificate

connection.client_cert = OpenSSL::X509::Certificate.new(File.read("client.pem"))

client_key [RW]

The private key of {#client_cert}

@api private @return [OpenSSL::PKey::PKey, nil] the private key, or nil to present no certificate @example Get or set the client key

connection.client_key = OpenSSL::PKey::RSA.new(File.read("client.key"))

Public Instance Methods

ca_file= (ca_file)

Set the path of a file of certificates TLS is verified with

@api private @param ca_file [String, nil] the path of the file, or nil to verify with the certificates OpenSSL trusts @return [void] @raise [ArgumentError] if the path does not name a file, in which case the path is left as it was @example Set the CA file

connection.ca_file = "/etc/ssl/certs/internal.pem"

# File lib/gems/certificate_options.rb, line 76
def ca_file=(ca_file)
  @ca_file = ca_file && validate_ca_file(ca_file)
end

ca_path= (ca_path)

Set the path of a directory of certificates TLS is verified with

@api private @param ca_path [String, nil] the path of the directory, or nil to verify with the certificates OpenSSL trusts @return [void] @raise [ArgumentError] if the path does not name a directory, in which case the path is left as it was @example Set the CA path

connection.ca_path = "/etc/ssl/certs"

# File lib/gems/certificate_options.rb, line 88
def ca_path=(ca_path)
  @ca_path = ca_path && validate_ca_path(ca_path)
end