Question

0

When using 'net/https' and ssl, how do I disable verification of the resulting SSL certificate?

asked Jun 11 at 16:59

community wiki

ChrisInEdmonton · Answer 1 · 2009-06-11 17:00:32Z

1

The following code will disable verification of the certificate. Note that this necessarily implies that invalid certificates will be accepted.

http.verify_mode = OpenSSL::SSL::VERIFY_NONE if http.use_ssl?

community wiki

	Which, in turn, implies that any code that does this is inherently a security hole. – EricLaw -MSFT- Jul 12 at 17:40
	This is most certainly true. It should be true that the security hole is exactly the same as if you had simply not used https in the first place. – ChrisInEdmonton Jul 16 at 14:58

Turn off SSL certificate verification in Ruby

1 Answer