Verify the server certificate

[mintuhouse]

I need to verify that I am talking with the same secure server before I do ldap.bind
I couldn't find anywhere in the documentation about how I could do it?
Is there a workaround which allows me to verify the certificate in ruby

Additional details:

1. The certificate which is passed on to me is same as the one I see when I run

openssl s_client -showcerts -connect "<host>:<port>" </dev/null 2>/dev/null|openssl x509 -outform PEM

1. I used http://www.ldapsoft.com/ to connect to client's server
   Unless I add the certificate file given to me in Security > Manage server certificates, I get a warning saying unknown security certificate
2. I tried do it manually first in plain ruby (without gem)
   But i get following error

test-ssl.rb:23:in `connect': SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed (OpenSSL::SSL::SSLError)

cert_store = OpenSSL::X509::Store.new
cert_store.add_file "server-wildcard.crt"
io = TCPSocket.new("SECURELDAP.UMC.EDU","636")
ctx = OpenSSL::SSL::SSLContext.new
#ctx.cert = OpenSSL::X509::Certificate.new(File.read("server-wildcard.crt"))
#ctx.client_ca = OpenSSL::X509::Certificate.new(File.read("server-wildcard.crt"))
#ctx.ca_file = "server-wildcard.crt"
#ctx.ca_path = "./"
ctx.verify_mode = OpenSSL::SSL::VERIFY_PEER | OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT
ctx.cert_store = cert_store
conn = OpenSSL::SSL::SSLSocket.new(io, ctx)
conn.connect

[jch]

Unfortunately, we do not verify server identities yet. It is part of the specification (RFC 4513 3.1.3) and the relevant area is here https://github.com/ruby-ldap/ruby-net-ldap/blob/master/lib/net/ldap/connection.rb#L69-L74 (emphasis mine)

The simple_tls method is intended as the simplest, stupidest, easiest

solution for people who want nothing more than encrypted comms with the

LDAP server. **It doesn't do any server-cert validation and requires

nothing in the way of key files and root-cert files**, etc etc. OBSERVE:

WE REPLACE the value of @conn, which is presumed to be a connected

TCPSocket object.

@mintuhouse I have not looked into how this should be implemented yet, but if you make progress on your workaround, please update us or submit a pull request as a proposal.

[hasan-chronus]

@jch Lost most of the context now.
But here is the implementation I used as a workaround
It is just a quick fix, might not handle all scenarios

[tarcieri]

You can probably close this ticket as there's a standing PR open #87

[jch]

See also #159.

Thanks @tarcieri