Class: HTTPClient::SSLConfig

Class | HTTPClient::SSLConfig
In: | lib/httpclient/ssl_config.rb
Parent: | Object

Represents SSL configuration for HTTPClient instance. The implementation depends on OpenSSL.

## Trust Anchor Control

SSLConfig loads ‘httpclient/cacert.p7s’ as a trust anchor (trusted certificate(s)) with set_trust_ca in initialization time. This means that HTTPClient instance trusts some CA certificates by default, like Web browsers. ‘httpclient/cacert.p7s’ is created by the author and included in released package.

‘cacert.p7s’ is automatically generated from JDK 1.6.

You may want to change trust anchor by yourself. Call clear_cert_store then set_trust_ca for that purpose.

### Methods

cert_store= ciphers= clear_cert_store client_cert= client_key= default_verify_callback new options= sample_verify_callback set_client_cert_file set_crl set_trust_ca timeout= verify_callback= verify_depth= verify_mode=

### Included Modules

OpenSSL

### Attributes

cert_store | [R] | OpenSSL::X509::X509::Store used for verification. You can reset the store with clear_cert_store and set the new store with cert_store=.
ciphers | [R] | A String of OpenSSL‘s cipher configuration. Default value is ALL:!ADH:!LOW:!EXP:!MD5:+SSLv2:@STRENGTH See ciphers(1) man in OpenSSL for more detail.
client_cert | [R] |
OpenSSL::X509::Certificate: | certificate for SSL client authenticateion.
nil by default. (no client authenticateion)
client_key | [R] |
OpenSSL::PKey::PKey: | private key for SSL client authentication.
nil by default. (no client authenticateion)
options | [R] | A number of OpenSSL‘s SSL options. Default value is OpenSSL::SSL::OP_ALL | OpenSSL::SSL::OP_NO_SSLv2
timeout | [R] | SSL timeout in sec. nil by default.
verify_callback | [R] | A callback handler for custom certificate verification. nil by default. If the handler is set, handler.call is invoked just after general OpenSSL‘s verification. handler.call is invoked with 2 arguments, ok and ctx; ok is a result of general OpenSSL‘s verification. ctx is a OpenSSL::X509::StoreContext.
verify_depth | [R] | A number of verify depth. Certification path which length is longer than this depth is not allowed.
verify_mode | [R] | A number which represents OpenSSL‘s verify mode. Default value is OpenSSL::SSL::VERIFY_PEER | OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT.

### Public Class methods

new(client)

Creates a SSLConfig.

### Public Instance methods

cert_store=(cert_store)

Sets new certificate store (OpenSSL::X509::Store). don‘t use if you don‘t know what it is.

Calling this method resets all existing sessions.

ciphers=(ciphers)

Sets cipher configuration. New value must be a String.

Calling this method resets all existing sessions.

clear_cert_store()

Drops current certificate store (OpenSSL::X509::Store) for SSL and create new one for the next session.

Calling this method resets all existing sessions.

client_cert=(client_cert)

Sets certificate (OpenSSL::X509::Certificate) for SSL client authentication. client_key and client_cert must be a pair.

Calling this method resets all existing sessions.

client_key=(client_key)

Sets private key (OpenSSL::PKey::PKey) for SSL client authentication. client_key and client_cert must be a pair.

Calling this method resets all existing sessions.

default_verify_callback(is_ok, ctx)

Default callback for verification: only dumps error.

options=(options)

Sets SSL options. New value must be a combination of # constants OpenSSL::SSL::OP_*

Calling this method resets all existing sessions.

sample_verify_callback(is_ok, ctx)

Sample callback method: CAUTION: does not check CRL/ARL.

set_client_cert_file(cert_file, key_file)

Sets certificate and private key for SSL client authentication.

cert_file: | must be a filename of PEM/DER formatted file.
key_file: | must be a filename of PEM/DER formatted file. Key must be an RSA key. If you want to use other PKey algorithm, use client_key=.

Calling this method resets all existing sessions.

set_crl(crl)

Adds CRL for verification.

crl: | a OpenSSL::X509::CRL or a filename of a PEM/DER formatted OpenSSL::X509::CRL.

Calling this method resets all existing sessions.

set_trust_ca(trust_ca_file_or_hashed_dir)

Sets trust anchor certificate(s) for verification.

trust_ca_file_or_hashed_dir: | a filename of a PEM/DER formatted OpenSSL::X509::Certificate or a ‘c-rehash‘eddirectory name which stores trusted certificate files.

Calling this method resets all existing sessions.

timeout=(timeout)

Sets SSL timeout in sec.

Calling this method resets all existing sessions.

verify_callback=(verify_callback)

Sets callback handler for custom certificate verification. See verify_callback.

Calling this method resets all existing sessions.

verify_depth=(verify_depth)

Sets verify depth. New value must be a number.

Calling this method resets all existing sessions.

verify_mode=(verify_mode)

Sets verify mode of OpenSSL. New value must be a combination of constants OpenSSL::SSL::VERIFY_*

Calling this method resets all existing sessions.

[Validate]