Set ssl version with Net::HTTP

user_2767213 0
Viewed 522

I have an old server that only accepts SSLv3 and SSLv3. I want to set the ssl version when I make the request.

http = Net::HTTP.new(@request.uri.host, @request.uri.port)
http.use_ssl = @request.uri.scheme == 'https'
http.ssl_version = :SSLv3
http.verify_mode = OpenSSL::SSL::VERIFY_NONE

leads to

[2020-09-10T05:37:14.452819 #254200] FATAL -- :   
OpenSSL::SSL::SSLError (SSL_CTX_set_min_proto_version):

I tried other combinations but failed. http.ssl_version = :SSLv3 http.ssl_version = "SSLv3"

How can I set the specific ssl version? I am using Ruby 2.7.1 and Rails 6. Thanks.

ruby-on-rails-6 openssl ubuntu ssl ruby
1 Answers

In most current versions of OpenSSL, the support for SSLv3 is statically disabled during compile time since the protocol is widely considered as insecure. As such, there is often no way to still use SSLv3 on those OpenSSL versions.

If SSLv3 is a hard requirement, you will likely have to first compile your own OpenSSL version with suitable configuration options, followed by the compilation of your Ruby against your custom OpenSSL.

Preferably, you should either update the server to support newer more secure protocols (such as TLSv1.2 or TLSv1.3) or ask the operator of the server to do so.

user_4217050
Related