Re: [jruby-user] Issue: Specifing jruby SSL keystore location

--001a11490dda3aac35051550cd98
Content-Type: text/plain; charset=UTF-8

might be a JRuby-OpenSSL regression ... please try *gem install
jruby-openssl* and make sure the installed gem gets loaded as some of the
older 1.7.x releases had issues not allowing to override default gems. thus
if possible I would upgrade JRuby 1.7.x as well - alternatively wait a few
hours and get a freshly baked 1.7.20 :) !

K.

On Fri, May 1, 2015 at 5:43 PM, Chason Choate <
[email protected]> wrote:

> Hello everyone,
>
> I've been having some trouble specifying a custom keystore for use with
> SSL. I'm creating a local CA and then creating a self-signed cert from that
> CA. Now I want to be able to start a Jetty server and hit it with jruby. My
> current issue is I can't seem to get jruby to pick up the local keystore
> and trust it. I'm hopeful someone has ran into this issue before or can
> walk me through how to fix it. Below is my test case:
>
> *Env:*
>
> * CentOS 6.5
> * Java 7
> * jruby-complete-1.7.12
>
> *Steps to reproduce:*
>
> * Install this simple jetty server (
> http://blog.knoldus.com/2013/09/10/configure-ssl-on-jetty-server-to-run-it-with-https/
> )
> * Run the commands to generate the CA and self-signed cert.
> * Start the jetty server (should be on 8443)
> * Use the following jruby script to contact the jetty server over SSL:
>
> require 'java'
> require 'net/https'
> host = 'localhost'
> path = '/'
>
> puts 'javax.net.ssl.trustStore = ' +
> java.lang.System.getProperty('javax.net.ssl.trustStore')
> puts 'javax.net.ssl.trustStorePassword = ' +
> java.lang.System.getProperty('javax.net.ssl.trustStorePassword')
>
> https = Net::HTTP.new(host, 8443)
> https.use_ssl = true
> https.ssl_timeout = 2
> https.verify_mode = OpenSSL::SSL::VERIFY_PEER
> response = https.request(Net::HTTP::Get.new('/'))
> puts response.body
>
> * If everything is working correctly you should see HTML dumped to your
> terminal.
> * Otherwise if there are issues verifying the certificates you'll see an
> error like: (which is what i'm seeing)
>
> [vagrant@localhost ~]$ java
> -Djavax.net.ssl.trustStore=~/jetty-hightide-8.1.8.v20121106/etc/certs/keystore
> -D -Djavax.net.ssl.trustStorePassword=changeit -jar
> /path/to/jruby-complete-1.7.12.jar local.rb
> javax.net.ssl.trustStore =
> ~/jetty-hightide-8.1.8.v20121106/etc/certs/keystore
> javax.net.ssl.trustStorePassword = changeit
> OpenSSL::SSL::SSLError: certificate verify failed
>    connect at org/jruby/ext/openssl/SSLSocket.java:170
>    connect at
> file:/synthesysserver/lib/jruby-complete-1.7.12.jar!/META-INF/jruby.home/lib/ruby/1.9/net/http.rb:799
>    timeout at org/jruby/ext/timeout/Timeout.java:104
>    connect at
> file:/synthesysserver/lib/jruby-complete-1.7.12.jar!/META-INF/jruby.home/lib/ruby/1.9/net/http.rb:799
>   do_start at
> file:/synthesysserver/lib/jruby-complete-1.7.12.jar!/META-INF/jruby.home/lib/ruby/1.9/net/http.rb:755
>      start at
> file:/synthesysserver/lib/jruby-complete-1.7.12.jar!/META-INF/jruby.home/lib/ruby/1.9/net/http.rb:744
>    request at
> file:/synthesysserver/lib/jruby-complete-1.7.12.jar!/META-INF/jruby.home/lib/ruby/1.9/net/http.rb:1292
>     (root) at local.rb:13
>
>
> --
> Thanks,
> Chason Choate
>

--001a11490dda3aac35051550cd98
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><br></div>might be a JRuby-OpenSSL regression ... ple=
ase try <i>gem install jruby-openssl</i> and make sure the installed gem ge=
ts loaded as some of the older 1.7.x releases had issues not allowing to ov=
erride default gems. thus if possible I would upgrade JRuby 1.7.x as well -=
 alternatively wait a few hours and get a freshly baked 1.7.20 :) !<br><div=
><div class=3D"gmail_extra"><br></div><div class=3D"gmail_extra">K.<br></di=
v><div class=3D"gmail_extra"><br><div class=3D"gmail_quote">On Fri, May 1, =
2015 at 5:43 PM, Chason Choate <span dir=3D"ltr">&lt;<a href=3D"mailto:chas=
[email protected]" target=3D"_blank">chason.choate@digitalreas=
oning.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=
=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=
=3D"ltr">Hello everyone,<div><br></div><div>I&#39;ve been having some troub=
le specifying a custom keystore for use with SSL. I&#39;m creating a local =
CA and then creating a self-signed cert from that CA. Now I want to be able=
 to start a Jetty server and hit it with jruby. My current issue is I can&#=
39;t seem to get jruby to pick up the local keystore and trust it. I&#39;m =
hopeful someone has ran into this issue before or can walk me through how t=
o fix it. Below is my test case:<div><br></div><div><b>Env:</b></div><div><=
br></div><div>* CentOS 6.5</div><div>* Java 7</div><div>* jruby-complete-1.=
7.12</div><div><br></div><div><b>Steps to reproduce:</b><br><div><br></div>=
<div>* Install this simple jetty server (<a href=3D"http://blog.knoldus.com=
/2013/09/10/configure-ssl-on-jetty-server-to-run-it-with-https/" target=3D"=
_blank">http://blog.knoldus.com/2013/09/10/configure-ssl-on-jetty-server-to=
-run-it-with-https/</a>)</div><div>* Run the commands to generate the CA an=
d self-signed cert.</div><div>* Start the jetty server (should be on 8443)<=
/div><div>* Use the following jruby script to contact the jetty server over=
 SSL:</div><div><br></div><div><div><font face=3D"monospace, monospace">req=
uire &#39;java&#39;</font></div><div><font face=3D"monospace, monospace">re=
quire &#39;net/https&#39;</font></div><div><font face=3D"monospace, monospa=
ce">host =3D &#39;localhost&#39;</font></div><div><font face=3D"monospace, =
monospace">path =3D &#39;/&#39;</font></div><div><font face=3D"monospace, m=
onospace"><br></font></div><div><font face=3D"monospace, monospace">puts &#=
39;javax.net.ssl.trustStore =3D &#39; + java.lang.System.getProperty(&#39;j=
avax.net.ssl.trustStore&#39;)</font></div><div><font face=3D"monospace, mon=
ospace">puts &#39;javax.net.ssl.trustStorePassword =3D &#39; + java.lang.Sy=
stem.getProperty(&#39;javax.net.ssl.trustStorePassword&#39;)</font></div><d=
iv><font face=3D"monospace, monospace"><br></font></div><div><font face=3D"=
monospace, monospace">https =3D Net::HTTP.new(host, 8443)</font></div><div>=
<font face=3D"monospace, monospace">https.use_ssl =3D true</font></div><div=
><font face=3D"monospace, monospace">https.ssl_timeout =3D 2</font></div><d=
iv><font face=3D"monospace, monospace">https.verify_mode =3D OpenSSL::SSL::=
VERIFY_PEER</font></div><div><font face=3D"monospace, monospace">response =
=3D https.request(Net::HTTP::Get.new(&#39;/&#39;))</font></div><div><font f=
ace=3D"monospace, monospace">puts response.body</font></div></div><div><div=
><br></div><div>* If everything is working correctly you should see HTML du=
mped to your terminal.</div><div>* Otherwise if there are issues verifying =
the certificates you&#39;ll see an error like: (which is what i&#39;m seein=
g)</div><div><br></div><div><div><font face=3D"monospace, monospace">[vagra=
nt@localhost ~]$ java -Djavax.net.ssl.trustStore=3D~/jetty-hightide-8.1.8.v=
20121106/etc/certs/keystore -D -Djavax.net.ssl.trustStorePassword=3Dchangei=
t -jar /path/to/jruby-complete-1.7.12.jar local.rb</font></div><div><font f=
ace=3D"monospace, monospace">javax.net.ssl.trustStore =3D ~/jetty-hightide-=
8.1.8.v20121106/etc/certs/keystore</font></div><div><font face=3D"monospace=
, monospace">javax.net.ssl.trustStorePassword =3D changeit</font></div><div=
><font face=3D"monospace, monospace">OpenSSL::SSL::SSLError: certificate ve=
rify failed</font></div><div><font face=3D"monospace, monospace">=C2=A0 =C2=
=A0connect at org/jruby/ext/openssl/SSLSocket.java:170</font></div><div><fo=
nt face=3D"monospace, monospace">=C2=A0 =C2=A0connect at file:/synthesysser=
ver/lib/jruby-complete-1.7.12.jar!/META-INF/jruby.home/lib/ruby/1.9/net/htt=
p.rb:799</font></div><div><font face=3D"monospace, monospace">=C2=A0 =C2=A0=
timeout at org/jruby/ext/timeout/Timeout.java:104</font></div><div><font fa=
ce=3D"monospace, monospace">=C2=A0 =C2=A0connect at file:/synthesysserver/l=
ib/jruby-complete-1.7.12.jar!/META-INF/jruby.home/lib/ruby/1.9/net/http.rb:=
799</font></div><div><font face=3D"monospace, monospace">=C2=A0 do_start at=
 file:/synthesysserver/lib/jruby-complete-1.7.12.jar!/META-INF/jruby.home/l=
ib/ruby/1.9/net/http.rb:755</font></div><div><font face=3D"monospace, monos=
pace">=C2=A0 =C2=A0 =C2=A0start at file:/synthesysserver/lib/jruby-complete=
-1.7.12.jar!/META-INF/jruby.home/lib/ruby/1.9/net/http.rb:744</font></div><=
div><font face=3D"monospace, monospace">=C2=A0 =C2=A0request at file:/synth=
esysserver/lib/jruby-complete-1.7.12.jar!/META-INF/jruby.home/lib/ruby/1.9/=
net/http.rb:1292</font></div><div><font face=3D"monospace, monospace">=C2=
=A0 =C2=A0 (root) at local.rb:13</font></div></div><span class=3D"HOEnZb"><=
font color=3D"#888888"><div><font face=3D"monospace, monospace"><br></font>=
</div><div><font face=3D"monospace, monospace"><br></font></div>-- <br><div=
><div dir=3D"ltr">Thanks,<div>Chason Choate</div></div></div>
</font></span></div></div></div></div>
</blockquote></div><br></div></div></div>

--001a11490dda3aac35051550cd98--