about summary refs log tree commit homepage
path: root/Documentation
diff options
context:
space:
mode:
authorEric Wong <e@80x24.org>2016-03-16 00:34:34 +0000
committerEric Wong <e@80x24.org>2016-04-06 06:35:18 +0000
commit0d9d05679247a6e77a24bf19d59035cec872a6f4 (patch)
treebdfe26dfc1c12ee74d4f7be53967f7bae33c3932 /Documentation
parent8c9f33a5396d2792b9bdbdfd785f6feba2fb7514 (diff)
downloadyahns-0d9d05679247a6e77a24bf19d59035cec872a6f4.tar.gz
The Ruby default parameters on top of OpenSSL seem designed
for client usage.  For server usage, requiring client-side
certificate verification is uncommon for HTTPS sites.

So follow what WEBrick does for HTTPS and use SSL_VERIFY_NONE
in our documentation.

Thanks-to: Shota Fukumori (sora_h) <her@sorah.jp>
on the unicorn list:

<CA+wiQwuE=ya6F4s4k3GCTUppk7mbBOYOVwVXhTsX2SP8mgdmNQ@mail.gmail.com>
Diffstat (limited to 'Documentation')
-rw-r--r--Documentation/yahns_config.pod5
1 files changed, 4 insertions, 1 deletions
diff --git a/Documentation/yahns_config.pod b/Documentation/yahns_config.pod
index 1b2595b..d8c6801 100644
--- a/Documentation/yahns_config.pod
+++ b/Documentation/yahns_config.pod
@@ -446,7 +446,10 @@ An example which seems to work is:
   ssl_ctx.key = OpenSSL::PKey::RSA.new(
     IO.read('/etc/ssl/private/example.key')
   )
-  ssl_ctx.set_params # use defaults provided by Ruby on top of OpenSSL
+
+  # use defaults provided by Ruby on top of OpenSSL,
+  # but disable client certificate verification as it is rare:
+  ssl_ctx.set_params(verify_mode: OpenSSL::SSL::VERIFY_NONE)
 
   app(:rack, "/path/to/my/app/config.ru") do
     listen 443, ssl_ctx: ssl_ctx