From a6c0f95705fe790775deb86772173a897322bdc1 Mon Sep 17 00:00:00 2001 From: Stan Hu Date: Mon, 15 Jul 2019 09:28:56 -0700 Subject: [PATCH] Make httpclient respect system SSL configuration By default, httpclient (and hence anything that uses rack-oauth2) ignores the system-wide SSL certificate configuration in favor of its own `cacert.pem`. This makes it impossible to use custom certificates without patching that file. Until https://github.com/nahi/httpclient/pull/386 is merged, we work around this limitation by forcing the `HTTPClient` SSL store to use the default system configuration. Closes https://gitlab.com/charts/gitlab/issues/1436 --- .../unreleased/sh-fix-httpclient-ssl.yml | 5 +++++ config/initializers/httpclient_patch.rb | 18 ++++++++++++++++++ 2 files changed, 23 insertions(+) create mode 100644 changelogs/unreleased/sh-fix-httpclient-ssl.yml create mode 100644 config/initializers/httpclient_patch.rb diff --git a/changelogs/unreleased/sh-fix-httpclient-ssl.yml b/changelogs/unreleased/sh-fix-httpclient-ssl.yml new file mode 100644 index 00000000000..fda4e2e7084 --- /dev/null +++ b/changelogs/unreleased/sh-fix-httpclient-ssl.yml @@ -0,0 +1,5 @@ +--- +title: Make httpclient respect system SSL configuration +merge_request: 30749 +author: +type: fixed diff --git a/config/initializers/httpclient_patch.rb b/config/initializers/httpclient_patch.rb new file mode 100644 index 00000000000..22cc5605d9b --- /dev/null +++ b/config/initializers/httpclient_patch.rb @@ -0,0 +1,18 @@ +# frozen_string_literal: true + +# By default, httpclient (and hence anything that uses rack-oauth2) +# ignores the system-wide SSL certificate configuration in favor of its +# own cacert.pem. This makes it impossible to use custom certificates +# without patching that file. Until +# https://github.com/nahi/httpclient/pull/386 is merged, we work around +# this limitation by forcing the HTTPClient SSL store to use the default +# system configuration. +module HTTPClient::SSLConfigDefaultPaths + def initialize(client) + super + + set_default_paths + end +end + +HTTPClient::SSLConfig.prepend HTTPClient::SSLConfigDefaultPaths