1

I'm trying to connect to FTP over TLS on Heroku, with rails 1.9

Rails 1.9 doesn't include FTPTLS, so I've copied the Rails 1.8 ftptls.rb file into lib/assets.

This works fine on localhost, but fails when I push it to Heroku because the certificate verification fails.

lib/assets/ftptls.rb:

=begin
= $RCSfile$ -- SSL/TLS enhancement for Net::HTTP.

= Info
  'OpenSSL for Ruby 2' project
  Copyright (C) 2003 Blaz Grilc <farmer@gmx.co.uk>
  All rights reserved.

= Licence
  This program is licenced under the same licence as Ruby.
  (See the file 'LICENCE'.)

= Requirements

= Version
  $Id: ftptls.rb 13657 2007-10-08 11:16:54Z gotoyuzo $

= Notes
  Tested on FreeBSD 5-CURRENT and 4-STABLE
  - ruby 1.6.8 (2003-01-17) [i386-freebsd5]
  - OpenSSL 0.9.7a Feb 19 2003
  - ruby-openssl-0.2.0.p0
  tested on ftp server: glftpd 1.30
=end

require 'socket'
require 'openssl'
require 'net/ftp'

module Net
  class FTPTLS < FTP
    def connect(host, port=FTP_PORT)
      @hostname = host
      super
    end

    def login(user = "anonymous", passwd = nil, acct = nil)
       store = OpenSSL::X509::Store.new
       store.set_default_paths
       ctx = OpenSSL::SSL::SSLContext.new('SSLv23')
       ctx.cert_store = store
       ctx.verify_mode = OpenSSL::SSL::VERIFY_PEER
       ctx.key = nil
       ctx.cert = nil
       voidcmd("AUTH TLS")
       @sock = OpenSSL::SSL::SSLSocket.new(@sock, ctx)
       @sock.connect
       @sock.post_connection_check(@hostname)
       super(user, passwd, acct)
       voidcmd("PBSZ 0")
    end
  end
end

The error from Heroku:

SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed

I found this thread regarding https connection: http://www.quora.com/What-is-the-path-to-the-SSL-root-certificate-trusted-root-CA-on-Heroku

So I tried adding this to my ftptls.rb file, but the error remained.

ctx.ca_file = '/usr/lib/ssl/certs/ca-certificates.crt'

Any thoughts for getting this to work?

user229044
  • 232,980
  • 40
  • 330
  • 338
Colin
  • 2,814
  • 5
  • 27
  • 37
  • Are you confident that your FTPTLS server has a certificate signed by one of the authorities in `/usr/lib/ssl/certs/ca-certificates.crt`? – sarnold Jun 29 '12 at 01:40
  • Interesting point. Not 100%, I'll do some testing tomorrow and see what I figure out. What are my options if not? Can I just copy the cert file from my localhost and point to that? – Colin Jun 29 '12 at 01:52
  • I still haven't gotten this working. I pushed a support ticket to Heroku for more assistance. Is there any reason my local ca_file would be different from Heroku's? – Colin Jun 29 '12 at 20:19
  • Different distributions have different collections; you probably could copy your local one over and use it instead, but that may miss updates that remove CAs or add CAs... – sarnold Jun 29 '12 at 22:23
  • Hey- I just posted an answer to a related question which might help you out: http://stackoverflow.com/q/9794504/134495 – Daryl Apr 08 '13 at 17:33

0 Answers0