views:

749

answers:

1

When using 'net/https' and ssl, how do I disable verification of the resulting SSL certificate?

+1  A: 

The following code will disable verification of the certificate. Note that this necessarily implies that invalid certificates will be accepted.

http.verify_mode = OpenSSL::SSL::VERIFY_NONE if http.use_ssl?
ChrisInEdmonton
Which, in turn, implies that any code that does this is inherently a security hole.
EricLaw -MSFT-
This is most certainly true. It should be true that the security hole is exactly the same as if you had simply not used https in the first place.
ChrisInEdmonton