# Open-uri + OpenSSL **URL:** \ **Category:** Ruby\ **Created:** [October 27, 2007, 7:35am UTC](https://www.ruby-forum.com/t/open-uri-openssl/118462 "2007-10-27T07:35:49Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![turnkeytraders](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ba8739/32.png) [@turnkeytraders](https://www.ruby-forum.com/u/turnkeytraders)\ **Post date:** [October 27, 2007, 7:35am UTC](https://www.ruby-forum.com/t/open-uri-openssl/118462/1 "2007-10-27T07:35:49Z")
Hello, I am usring open-uri to open an https:// link and when it tries to read it, I get the ‘connect’ : certificate verify failed error. How can I bypass this SSL verification? Thanks, M ---
**Author:** ![turnkeytraders](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ba8739/32.png) [@turnkeytraders](https://www.ruby-forum.com/u/turnkeytraders)\ **Post date:** [October 27, 2007, 7:05pm UTC](https://www.ruby-forum.com/t/open-uri-openssl/118462/2 "2007-10-27T19:05:23Z")
On Oct 27, 1:35 am, Matthew L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Hello, > > I am usring open-uri to open an https:// link and when it tries to read > it, I get the ‘connect’ : certificate verify failed error. How can I > bypass this SSL verification? > > ## Thanks, M > > Posted viahttp://www.ruby-forum.com/. Set the verify\_mode to OpenSSL::SSL::VERIFY\_NONE eg: http = Net::HTTP.new(host,port) http.use\_ssl = true http.verify\_mode = OpenSSL::SSL::VERIFY\_NONE ---
**Author:** ![turnkeytraders](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ba8739/32.png) [@turnkeytraders](https://www.ruby-forum.com/u/turnkeytraders)\ **Post date:** [October 27, 2007, 7:26pm UTC](https://www.ruby-forum.com/t/open-uri-openssl/118462/3 "2007-10-27T19:26:21Z")
Ok when I do that, it says: ssl value changed, but session already started dusty wrote: > On Oct 27, 1:35 am, Matthew L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > Hello, > > > > I am usring open-uri to open an https:// link and when it tries to read > > it, I get the ‘connect’ : certificate verify failed error. How can I > > bypass this SSL verification? > > > > ## Thanks, M > > > > Posted viahttp://www.ruby-forum.com/. > > Set the verify\_mode to OpenSSL::SSL::VERIFY\_NONE > > eg: > > http = Net::HTTP.new(host,port) > http.use\_ssl = true > http.verify\_mode = OpenSSL::SSL::VERIFY\_NONE ---
**Author:** ![turnkeytraders](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ba8739/32.png) [@turnkeytraders](https://www.ruby-forum.com/u/turnkeytraders)\ **Post date:** [November 6, 2007, 3:04am UTC](https://www.ruby-forum.com/t/open-uri-openssl/118462/4 "2007-11-06T03:04:41Z")
On Nov 5, 8:51 pm, dusty [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > > Hello, > > > > Set the verify\_mode to OpenSSL::SSL::VERIFY\_NONE > > > > Sorry, I guess you can’t do it with open-uri. Here is a patch: > > > > :http\_basic\_authentication =\> true, > > > > :ssl\_verify =\> true > > > > http.verify\_mode = OpenSSL::SSL::VERIFY\_PEER > > > > if options[:ssl\_verify] == false > > open(“[https://someurl](https://someurl)”, :ssl\_verify =\> false) {|f| > print f.read > > } Sorry, this all goes in open-uri.rb in your ruby base dir, eg: /usr/lib/ruby/1.8/open-uri.rb or /opt/local/lib/ruby/1.8/open-uri.rb or wherever it may be on your distro. ---
**Author:** ![turnkeytraders](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ba8739/32.png) [@turnkeytraders](https://www.ruby-forum.com/u/turnkeytraders)\ **Post date:** [November 6, 2007, 5:35am UTC](https://www.ruby-forum.com/t/open-uri-openssl/118462/5 "2007-11-06T05:35:29Z")
dusty wrote: > > > > > I am usring open-uri to open an https:// link and when it tries to read > > > > > http.verify\_mode = OpenSSL::SSL::VERIFY\_NONE > > > > > :proxy =\> true, > > > > > :progress\_proc =\> true, > > > > > require ‘net/https’ > > > > > require ‘net/https’ > > > > > end > > /usr/lib/ruby/1.8/open-uri.rb > or > /opt/local/lib/ruby/1.8/open-uri.rb > > or wherever it may be on your distro. The nice thing about Ruby is that if you don’t want to modify your system files (for example I don’t like to do it because it’s quite hard to track later), then you can simply patch the modules/classes in question on the fly, at the beginning of your application. And possibly file a bug report (: However, I guess the verification-enabling code would be more versatile this way: ``` if options[:ssl_verify] http.verify_mode = OpenSSL::SSL::VERIFY_PEER else http.verify_mode = OpenSSL::SSL::VERIFY_NONE end ``` mortee ---
**Author:** ![turnkeytraders](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ba8739/32.png) [@turnkeytraders](https://www.ruby-forum.com/u/turnkeytraders)\ **Post date:** [November 6, 2007, 3:00am UTC](https://www.ruby-forum.com/t/open-uri-openssl/118462/6 "2007-11-06T03:00:00Z")
On Oct 27, 12:26 pm, Matthew L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > I am usring open-uri to open an https:// link and when it tries to read > > > eg: > > > http = Net::HTTP.new(host,port) > > http.use\_ssl = true > > http.verify\_mode = OpenSSL::SSL::VERIFY\_NONE > > – > Posted viahttp://www.ruby-forum.com/. Sorry, I guess you can’t do it with open-uri. Here is a patch: add this ssl\_verify option to the top of the file. FROM: module OpenURI Options = { :proxy =\> true, :progress\_proc =\> true, :content\_length\_proc =\> true, :http\_basic\_authentication =\> true, } TO: module OpenURI Options = { :proxy =\> true, :progress\_proc =\> true, :content\_length\_proc =\> true, :http\_basic\_authentication =\> true, :ssl\_verify =\> true } Change the part where it enables verification FROM: ``` if target.class == URI::HTTPS require 'net/https' http.use_ssl = true http.enable_post_connection_check = true http.verify_mode = OpenSSL::SSL::VERIFY_PEER store = OpenSSL::X509::Store.new store.set_default_paths http.cert_store = store end ``` TO: if target.class == URI::HTTPS require ‘net/https’ http.use\_ssl = true http.enable\_post\_connection\_check = true if options[:ssl\_verify] == false http.verify\_mode = OpenSSL::SSL::VERIFY\_NONE else http.verify\_mode = OpenSSL::SSL::VERIFY\_PEER end store = OpenSSL::X509::Store.new store.set\_default\_paths http.cert\_store = store end run it like this: open(“[https://someurl](https://someurl)”, :ssl\_verify =\> false) {|f| print f.read } ---
**Author:** ![turnkeytraders](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ba8739/32.png) [@turnkeytraders](https://www.ruby-forum.com/u/turnkeytraders)\ **Post date:** [November 6, 2007, 1:14pm UTC](https://www.ruby-forum.com/t/open-uri-openssl/118462/7 "2007-11-06T13:14:03Z")
Great thanks guys! ---
**Author:** ![turnkeytraders](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ba8739/32.png) [@turnkeytraders](https://www.ruby-forum.com/u/turnkeytraders)\ **Post date:** [November 6, 2007, 3:35pm UTC](https://www.ruby-forum.com/t/open-uri-openssl/118462/8 "2007-11-06T15:35:55Z")
On Nov 5, 11:34 pm, mortee [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > > > > it, I get the ‘connect’ : certificate verify failed error. How can I > > > > > > – > > > > > > :progress\_proc =\> true, > > > > > > :content\_length\_proc =\> true, > > > > > > http.use\_ssl = true > > > > > > http.use\_ssl = true > > > or > > However, I guess the verification-enabling code would be more versatile > > this way: > > ``` > if options[:ssl_verify] > http.verify_mode = OpenSSL::SSL::VERIFY_PEER > else > http.verify_mode = OpenSSL::SSL::VERIFY_NONE > end > > ``` > > mortee Good idea. I submitted a patch to rubyforge. This might be useful and simple enough to add. [http://rubyforge.org/tracker/?group\_id=426&atid=1698&func=detail&aid=15390](http://rubyforge.org/tracker/?group_id=426&atid=1698&func=detail&aid=15390) ---
**Author:** ![turnkeytraders](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ba8739/32.png) [@turnkeytraders](https://www.ruby-forum.com/u/turnkeytraders)\ **Post date:** [June 2, 2008, 1:01pm UTC](https://www.ruby-forum.com/t/open-uri-openssl/118462/9 "2008-06-02T13:01:51Z")
Any news about the status of this? ---
**Author:** ![turnkeytraders](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ba8739/32.png) [@turnkeytraders](https://www.ruby-forum.com/u/turnkeytraders)\ **Post date:** [June 2, 2008, 5:12pm UTC](https://www.ruby-forum.com/t/open-uri-openssl/118462/10 "2008-06-02T17:12:44Z")
On Jun 2, 7:01 am, Marc H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > ## Any news about the status of this? > > Posted viahttp://www.ruby-forum.com/. i too am waiting for this patch. appreciate early response. Seede ---
**Author:** ![turnkeytraders](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ba8739/32.png) [@turnkeytraders](https://www.ruby-forum.com/u/turnkeytraders)\ **Post date:** [June 2, 2008, 5:36pm UTC](https://www.ruby-forum.com/t/open-uri-openssl/118462/11 "2008-06-02T17:36:31Z")
On Jun 2, 7:01 am, Marc H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > ## Any news about the status of this? > > Posted viahttp://www.ruby-forum.com/. i tried to put the patch into my open-uri.rb and it failed with a new error irb(main):007:0\* open(“[https://www.interactivebrokers.com/Universal/](https://www.interactivebrokers.com/Universal/) servlet/FlexStatementService.GetStatement? t=1437758&q=1126698&v=2”,:ssl\_verify =\> true){|f|puts f} NoMethodError: undefined method `enable_post_connection_check=' for # from e:/ruby/lib/ruby/1.8/open-uri.rb:242:in `open\_http’ from e:/ruby/lib/ruby/1.8/open-uri.rb:643:in `buffer_open' from e:/ruby/lib/ruby/1.8/open-uri.rb:170:in `open\_loop’ from e:/ruby/lib/ruby/1.8/open-uri.rb:168:in `catch' from e:/ruby/lib/ruby/1.8/open-uri.rb:168:in `open\_loop’ from e:/ruby/lib/ruby/1.8/open-uri.rb:138:in `open_uri' from e:/ruby/lib/ruby/1.8/open-uri.rb:545:in `open’ from e:/ruby/lib/ruby/1.8/open-uri.rb:30:in `open’ from (irb):7 ---
**Author:** ![turnkeytraders](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ba8739/32.png) [@turnkeytraders](https://www.ruby-forum.com/u/turnkeytraders)\ **Post date:** [June 13, 2012, 11:09am UTC](https://www.ruby-forum.com/t/open-uri-openssl/118462/12 "2012-06-13T11:09:21Z")
Although the ticket remains as open in the page, the feature has been added at least for ruby-1.9.3-p125. You can pass :ssl\_verify\_mode =\> OpenSSL::SSL::VERIFY\_NONE as an option to the open method. Best Regards ---
**Author:** ![turnkeytraders](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ba8739/32.png) [@turnkeytraders](https://www.ruby-forum.com/u/turnkeytraders)\ **Post date:** [June 28, 2009, 11:05pm UTC](https://www.ruby-forum.com/t/open-uri-openssl/118462/13 "2009-06-28T23:05:22Z")
Junkone wrote: > On Jun 2, 7:01�am, Marc H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > ## Any news about the status of this? > > > > Posted viahttp://www.ruby-forum.com/. > > i tried to put the patch into my open-uri.rb and it failed with a new > error > irb(main):007:0\* open(“[https://www.interactivebrokers.com/Universal/](https://www.interactivebrokers.com/Universal/) > servlet/FlexStatementService.GetStatement? > t=1437758&q=1126698&v=2”,:ssl\_verify =\> true){|f|puts f} > NoMethodError: undefined method `enable_post_connection_check=' for # from e:/ruby/lib/ruby/1.8/open-uri.rb:242:in `open\_http’ > from e:/ruby/lib/ruby/1.8/open-uri.rb:643:in `buffer_open' from e:/ruby/lib/ruby/1.8/open-uri.rb:170:in `open\_loop’ > from e:/ruby/lib/ruby/1.8/open-uri.rb:168:in `catch' from e:/ruby/lib/ruby/1.8/open-uri.rb:168:in `open\_loop’ > from e:/ruby/lib/ruby/1.8/open-uri.rb:138:in `open_uri' from e:/ruby/lib/ruby/1.8/open-uri.rb:545:in `open’ > from e:/ruby/lib/ruby/1.8/open-uri.rb:30:in `open’ > from (irb):7 So basically if you are using ruby 1.8.6 (for me I’m using it on BackTrack3) you simply omit the ‘http.enable\_post\_connection\_check = true’ from the code mentioned above and also remove ‘sock.post\_connection\_check(target\_host)’ that’s it! I am using the open-uri just fine now to push thru multiple URLs from an input file out to my local proxy in order to built a site map via BurpSuite. ---
**Author:** ![turnkeytraders](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ba8739/32.png) [@turnkeytraders](https://www.ruby-forum.com/u/turnkeytraders)\ **Post date:** [October 4, 2013, 4:31am UTC](https://www.ruby-forum.com/t/open-uri-openssl/118462/14 "2013-10-04T04:31:16Z")
As Fernando points out, this feature is now available, at least post 1.9.3-p327. Here’s how I’m using it: request\_uri=URI.parse(‘myurl’) request\_uri.query=URI.encode\_www\_form params output = open(request\_uri, {ssl\_verify\_mode: OpenSSL::SSL::VERIFY\_NONE}) obj = JSON.parse output.readlines.join("") sameer.