always_verify_ssl_certificates

Ruby’s net/http is setup to never verify SSL certificates by default. Most ruby libraries do the same. That means that you’re not verifying the identity of the server you’re communicating with and are therefore exposed to man in the middle attacks. This gem monkey-patches net/http to force certificate verification and make turning it off impossible.

All you need to do is require this gem, and set a path to your certificate authority bundle or directory:

$ gem install always_verify_ssl_certificates

require "always_verify_ssl_certificates"
AlwaysVerifySSLCertificates.ca_file = "/etc/pki/tls/certs/ca-bundle.crt" # the centos location

You can find that bundle at the following locations on various operating systems

CentOS / RHEL (I assume): AlwaysVerifySSLCertificates.ca_file = /etc/pki/tls/certs/ca-bundle.crt
Debian: AlwaysVerifySSLCertificates.ca_path = /etc/ssl/certs
OS X: ????

always_verify_ssl_certificates

Copyright