Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>My guess is that the trusted list of CA certificates that openssl is using to verify Moneris' server certificate is out-dated. So try getting the cacert.pem extracted from Mozilla's ca-bundle (<a href="http://curl.haxx.se/docs/caextract.html" rel="nofollow">http://curl.haxx.se/docs/caextract.html</a> does this for you). This is more necessary these days as far as openssl is concerned as openssl is no longer bundled with CA certs which is why I'm suspecting whatever ca-certs you're using might be out of date.</p> <p>First I tried to reproduce your problem with the command:</p> <p>openssl s_client -connect www3.moneris.com:443</p> <p>and got ...</p> <pre> New, TLSv1/SSLv3, Cipher is RC4-MD5 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1.2 Cipher : RC4-MD5 Session-ID: 73178D4019035AE86399D0E6D2FFB904A1412D0F5D3F83370E52F50E9E26B73C Session-ID-ctx: Master-Key: 0BB841912F11185B7CBAFA524571765DD7372990819EBC44E311DE4EF0C70E480501D6F87C8AA439C4F827B0908123F7 Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1380816775 Timeout : 300 (sec) Verify return code: 20 (unable to get local issuer certificate) --- </pre> <p>Then I used the cacert.pem extracted from Mozilla thanks to <a href="http://curl.haxx.se/docs/caextract.html" rel="nofollow">http://curl.haxx.se/docs/caextract.html</a> and re-issued the openssl command like so:</p> <p>openssl s_client -connect www3.moneris.com:443 -CAfile cacert.pem</p> <p>and got ...</p> <pre> New, TLSv1/SSLv3, Cipher is RC4-MD5 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1.2 Cipher : RC4-MD5 Session-ID: 73178D401902F7EB6399D0E6D2FFB804CE0F7219344405EA0E52F50E9E26B4DB Session-ID-ctx: Master-Key: C0B32810FB7E0158A156E7D05DBB35F3CE8935284F165C3FB636700EEEC8BCE991BCE8850D39020E298F337B6E58132A Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1380816992 Timeout : 300 (sec) Verify return code: 0 (ok) --- </pre> <p>So in your code snippet, above, try replacing:</p> <pre> self.ca_path = Rails.root.join('/usr/lib/ssl/certs/ca-certificates.crt').to_s </pre> <p>with:</p> <pre> self.ca_file = &lt;full path name&gt;/cacert.pem </pre> <p>where cacert.pem is extracted from the Mozilla ca-bundle</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload