OpenSSL::X509::StoreError returning "No message available"

[blerins]

Hi,

I'm getting an issue (rest-client/rest-client#302). Seems like error stored here (https://github.com/jruby/jruby-openssl/blob/master/src/main/java/org/jruby/ext/openssl/x509store/Store.java#L268) isn't recovered here (https://github.com/jruby/jruby-openssl/blob/master/src/main/java/org/jruby/ext/openssl/X509Store.java#L173). So thrown exception hasn't any message.
Shouldn't X509Errors be recovered before thowing the exception.

Thanks!

[kares]

thanks @blerins ... there's very little of us into diving deep - best thing you can do is to provide as with some sample (Ruby OpenSSL) code that can be used to save time trying to mimick the correct behaviour.

[blerins]

Here you are:

require 'openssl'

# Example from http://ruby-doc.org/stdlib-1.9.3/libdoc/openssl/rdoc/OpenSSL/X509/Certificate.html
# I don't know if so much stuff is necessary
root_key = OpenSSL::PKey::RSA.new 2048 # the CA's public/private key
root_ca = OpenSSL::X509::Certificate.new
root_ca.version = 2 # cf. RFC 5280 - to make it a "v3" certificate
root_ca.serial = 1
root_ca.subject = OpenSSL::X509::Name.parse "/DC=org/DC=ruby-lang/CN=Ruby CA"
root_ca.issuer = root_ca.subject # root CA's are "self-signed"
root_ca.public_key = root_key.public_key
root_ca.not_before = Time.now
root_ca.not_after = root_ca.not_before + 2 * 365 * 24 * 60 * 60 # 2 years validity
ef = OpenSSL::X509::ExtensionFactory.new
ef.subject_certificate = root_ca
ef.issuer_certificate = root_ca
root_ca.add_extension(ef.create_extension("basicConstraints","CA:TRUE",true))
root_ca.add_extension(ef.create_extension("keyUsage","keyCertSign, cRLSign", true))
root_ca.add_extension(ef.create_extension("subjectKeyIdentifier","hash",false))
root_ca.add_extension(ef.create_extension("authorityKeyIdentifier","keyid:always",false))
root_ca.sign(root_key, OpenSSL::Digest::SHA256.new)
### End of example

cert_store = OpenSSL::X509::Store.new
cert_store.add_cert(root_ca) # Success
cert_store.add_cert(root_ca) # Fails without message

Checked on Debian testing and windows 7 64

[kares]

fixed on master (will be in 0.9.6), thanks for reporting!

[blerins]

Great :D
Thanks a lot!

[sebglazebrook]

@kares Any idea when 0.9.6 will be released?

[kares]

no, if it's all up to me than I have not idea when I get time to look into the regressions I might have caused by other compatibility issues ;( ... I am really sorry about it, would love to fix those it just seems really time consuming (I failed previously for several days).

if anyone is into that it's the tests from JRuby's 1-7 line that need to be run against an updated jruby-openssl gem ... most annoying that I was unable to track is a cert.verify failure that started to happen.