2


My application uses the OAuth2 gem (0.1.1) to connect to Facebook, and the ActiveMerchant gem (1.12.0) to connect to PayPal. Under what is the current Rails/Ruby distribution (3.0.5, 1.9.2), both of these gems throw the following OpenSSL::SSL::SSLError when used:

  • SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed

I did some digging, and found two patches. The first involves plugging this into my initializers folder as "faraday.rb" (http://bit.ly/hZqNwQ). The OAuth2 (Facebook) side of things does work with this patch. However, the ActiveMerchant (PayPal) code still throws the same SSL_connect error.

The second patch I've tried (unsuccessfully) is the 'always_verify_ssl_certificates' gem (http://bit.ly/dXmuUh). I did the following things: (1) gem 'always_verify_ssl_certificates' in the Gemfile (2) require 'always_verify_ssl_certificates' in the ApplicationController file. However, both OAuth2 (Facebook) and ActiveMerchant (PayPal) throw the following TypeError:

  • wrong argument (NilClass)! (Expected kind of OpenSSL::SSL::SSLContext)

The links to my OAuth2 Facebook code AuthorizeController and my ActiveMerchant PayPal (PaymentsController as they stand now are in the comments below. This is after following the 2010 OAuth2 guide by Michael Bleigh and the 2008 Cody Fauser ActiveMerchant tutorial. Any help is greatly appreciated! I'm very confused at this point.

leahy16
  • 133
  • 7
  • OAuth2 Facebook code [AuthorizeController](http://pastie.org/1688774) and the ActiveMerchant PayPal controller [PaymentsController](http://pastie.org/pastes/1688754) – leahy16 Mar 19 '11 at 22:06

1 Answers1

-9

No need. After some painful Googling, putting the following into the ApplicationController fixes it. Hope this helps somebody! OpenSSL::SSL::VERIFY_PEER = OpenSSL::SSL::VERIFY_NONE

leahy16
  • 133
  • 7
  • 2
    This is a very bad solution. OAuth 2 relies on SSL entirely for its security. This compromises security by failing to check the validity of the SSL certificate. Seriously, don't do this, and absolutely do not recommend this to others. – Bob Aman Feb 22 '12 at 12:35