API Request - OpenSSL::SSL::SSLError: SSL_connect SYSCALL returned=5 errno=0 state=SSLv3 read server hello A

Question

Another of of these questions, I know this question has been asked (and answered) a lot on StackOverflow, but I can't get any of those to work for me and I also have a few questions I would like to learn.

Here is my error:

OpenSSL::SSL::SSLError: SSL_connect SYSCALL returned=5 errno=0 state=SSLv3 read server hello A

To start, here is my system settings.

I am on OSX El Capitan version 10.11.6

openssl version
 OpenSSL 0.9.8zh 14 Jan 2016

which openssl  
  /usr/bin/openssl

ruby -v 
  ruby 2.1.6p336 (2015-04-13 revision 50298) [x86_64-darwin14.0]

rbenv -v
  rbenv 0.4.0

My questions are these:

1) Does this error mean that a certificate was sent back to me, and then my OpenSSL version was unable to verify it? Did the other server have a chance to read mine, or even see it yet? Is there a way to dig into this request using Net::HTTP and inspect this other than opening up a program like Wireshark? Once I call net::HTTP.new.request(request) I seem to lose control and it just errors.

2) Did I even successfully talk to the other server, and it denied me?

3) At what point in the request am I in when I get this message?

and most of all

4) What are my options to get past this point

• 4a. So far i'm seeing a possible brew solution, but I haven't been able to get brew to link
• 4b. I could manually install Mozilla's CA (Or any other CA) into my Mac OSX Keychain
• 4c. Can I attach the file using the request.ca_file = "file" as I tried in my code? (see below)
• 4d. Is there any other solutions / best and most politically correct version?

5) Am I going to have this issue when I deploy to Heroku?

From what i'm reading, this is an issue of my OS not containing the correct CA files. the ca_file part is due to my first attempts to add the correct ca_file to my requests. I'm guessing I don't need that. I am using a Proxy with heroku because this API requires a static IP.

Here is my generic code

cert    = File.read(File.join(Rails.root, 'ssl', 'test_env', 'their_test_cert.der'))
ca_file = File.read(File.join(Rails.root, 'ssl', 'test_env', 'Class3PublicPrimaryCA.der'))

uri     = URI("https://xml.theirtestenv.com/api/receive")

headers              = {
  'x-IK-Version'       => 'IKR/V4.00',
}

proxy_host = "myproxyhose"
proxy_port = "1234"
proxy_user = "myproxyuser"
proxy_pass = "myproxypass"

proxy_request = Net::HTTP.new(uri.hostname, '443', proxy_host, proxy_port, proxy_user, proxy_pass)

# http.key = OpenSSL::PKey::RSA.new(rsa_key)

proxy_request.use_ssl = true
proxy_request.cert = OpenSSL::X509::Certificate.new(cert)
proxy_request.ca_file = ca_file
proxy_request.verify_mode     = OpenSSL::SSL::VERIFY_PEER
# proxy_request.ssl_version     = :SSLv3
# This doesn't seem to matter whether I put this or not...

# Tried variations of these...
# proxy_request.ssl_version = :TLSv1
# proxy_request.ciphers = ['DES-CBC3-SHA']

post_request = Net::HTTP::Post.new(uri, headers)
post_request.content_type = "multipart/related"

response = proxy_request.request(post_request)
puts response.inspect

Also, i've noticed no matter what proxy_requst.ssl_version I put, my error always specifies SSLv2/v3, does that mean on their end they are requiring that version?

Sorry for all the questions. Thanks in advance

Answer 1

It's been awhile, but I just wanted to post that this was a couple of issues, the certificates I was passing were not the correct ones they were for the wrong environment. Once the correct certificates were passed this started working, though I never got the SSL Version questions quite figured out.