Module: Ticketing::Tls

Defined in:
lib/ticketing/connection.rb

Overview

One-way TLS: the client verifies the server, never the reverse. 단방향 TLS: 클라이언트가 서버만 검증한다.

Class Method Summary collapse

Class Method Details

.build(tls) ⇒ Object

tls: nil(off) | 'system-roots' | 'insecure-skip-verify' | CA PEM path. Returns [ssl_context, verify_host]. 빌드 시 1회 결정.



14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
 
# File 'lib/ticketing/connection.rb', line 14

def build(tls)
  case tls
  when nil, "off"
    [nil, false]
  when "system-roots"
    context = OpenSSL::SSL::SSLContext.new
    context.verify_mode = OpenSSL::SSL::VERIFY_PEER
    context.cert_store = OpenSSL::X509::Store.new.tap(&:set_default_paths)
    [context, true]
  when "insecure-skip-verify"
    context = OpenSSL::SSL::SSLContext.new
    context.verify_mode = OpenSSL::SSL::VERIFY_NONE
    [context, false]
  else
    context = OpenSSL::SSL::SSLContext.new
    context.verify_mode = OpenSSL::SSL::VERIFY_PEER
    store = OpenSSL::X509::Store.new
    begin
      store.add_file(tls.to_s)
    rescue OpenSSL::X509::StoreError => e
      raise TicketError.new(:io, "TLS config load failed: #{tls} (#{e.message})")
    end
    context.cert_store = store
    [context, true]
  end
end