If you’ve used the RightAWS tools to talk to Amazon Web Services, you’ve probably seen this warning before:

warning: peer certificate won't be verified in this SSL session

No one likes warnings cluttering up their output, and this one indicates a very real security problem: no verification is being done to check that the server really is a legitimate Amazon host. Unfortunately, the warning doesn’t give you a lot of clues about how to go about addressing the issue.

Here’s what you need to do. First, you’ll need a certificate file. If you’re running Ubuntu, you can install the “ca-certificates” package (on my system it was already installed). Once it’s installed you should have a master certificate file at /etc/ssl/certs/ca-certificates.crt. Now you just need to tell RightAWS about the file:

require 'right_http_connection'
Rightscale::HttpConnection.params[:ca_file] = "/etc/ssl/certs/ca-certificates.crt"

…and you should get no more warnings.

I’ve submitted a patch to the right_http_connection gem which, if accepted, will use this file by default if it exists. It will also enable users to override the CA file configuration using the RIGHT_HTTP_CA_FILE environment variable.

Published by Avdi Grimm

9 Comments

  1. We TOTALLY have this problem and it has irritated me for a long time. But I never took the time to investigate it. Thanks man! Will fix right now!

    Reply
  2. Instructions for how to get the CA certificates file on other platforms are here:

    http://wiki.cacert.org/ImportRootCert#Linux

    and the certs themselves with fingerprints are here:

    http://www.cacert.org/index.php?id=3

    The particular one you need is:

    https://www.cacert.org/certs/root.crt

    Reply
  3. I've heard that theSSLstore.com is running a special on VeriSign Secure Site Pro with EV for only $899. I’ve just received an email from them.

    They are not publishing this offer on their site, so, use promo code VSSPEV02 to redeem. that's why I wanted to share it with you…!!!

    The link to redeem is http://www.thesslstore.com/VSSPEV/
    Hope this helps you…!!!

    Reply
  4. Hello friends,
    I come to know about that GeoTrust slashed the price on TrueBusiness ID with EV to $149/year
    It’s a great deal to get the certificate at very low price…..!!!
    2 Years @ $149.00/yr. [RRP: $1,573.00 ] You Save 81%…
    So just go for it………!!!
    You can collect more information from :
    http://blogs.thesslstore.com/ or
    https://www.thesslstore.com/geotrust/true-businessid-with-ev.aspx

    Reply
  5. Hello friends,
    I come to know about that GeoTrust slashed the price on TrueBusiness ID with EV to $149/year
    It’s a great deal to get the certificate at very low price…..!!!
    2 Years @ $149.00/yr. [RRP: $1,573.00 ] You Save 81%…
    So just go for it………!!!
    You can collect more information from :
    http://blogs.thesslstore.com/ or
    https://www.thesslstore.com/geotrust/true-businessid-with-ev.aspx

    Reply
  6. Awesome, solved the issue I was having. Thanks!

    Reply
  7. Awesome, solved the issue I was having. Thanks!

    Reply
  8. Great solution. Works perfectly. Thanks a million.

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *