When using 'net/https' and ssl, how do I disable verification of the resulting SSL certificate?
+1
A:
The following code will disable verification of the certificate. Note that this necessarily implies that invalid certificates will be accepted.
http.verify_mode = OpenSSL::SSL::VERIFY_NONE if http.use_ssl?
ChrisInEdmonton
2009-06-11 17:00:32
Which, in turn, implies that any code that does this is inherently a security hole.
EricLaw -MSFT-
2009-07-12 17:40:07
This is most certainly true. It should be true that the security hole is exactly the same as if you had simply not used https in the first place.
ChrisInEdmonton
2009-07-16 14:58:54