pact-ruby: Let's Encrypt certificate verify failed September 30th
This might be a better location for pact-1.59.0 issue part of https://github.com/pact-foundation/pact-ruby-standalone/issues/69
With https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/ seeing following (replaced our actual host with host.with.letsencrypt.cert.com):
STDERR:
opening connection to host.with.letsencrypt.cert.com:443...
opened
starting SSL for host.with.letsencrypt.cert.com:443...
SSL established
Conn close because of connect error SSL_connect returned=1 errno=0 state=error: certificate verify failed
Error making request - OpenSSL::SSL::SSLError SSL_connect returned=1 errno=0 state=error: certificate verify failed , attempt 1 of 3
opening connection to host.with.letsencrypt.cert.com:443...
opened
starting SSL for host.with.letsencrypt.cert.com:443...
SSL established
Conn close because of connect error SSL_connect returned=1 errno=0 state=error: certificate verify failed
Error making request - OpenSSL::SSL::SSLError SSL_connect returned=1 errno=0 state=error: certificate verify failed , attempt 2 of 3
opening connection to host.with.letsencrypt.cert.com:443...
opened
starting SSL for host.with.letsencrypt.cert.com:443...
SSL established
Conn close because of connect error SSL_connect returned=1 errno=0 state=error: certificate verify failed
Error making request - OpenSSL::SSL::SSLError SSL_connect returned=1 errno=0 state=error: certificate verify failed , attempt 3 of 3
/opt/pact/lib/ruby/lib/ruby/2.2.0/net/http.rb:923:in `connect': SSL_connect returned=1 errno=0 state=error: certificate verify failed (OpenSSL::SSL::SSLError)
from /opt/pact/lib/ruby/lib/ruby/2.2.0/net/http.rb:923:in `block in connect'
from /opt/pact/lib/ruby/lib/ruby/2.2.0/timeout.rb:74:in `timeout'
from /opt/pact/lib/ruby/lib/ruby/2.2.0/net/http.rb:923:in `connect'
from /opt/pact/lib/ruby/lib/ruby/2.2.0/net/http.rb:863:in `do_start'
from /opt/pact/lib/ruby/lib/ruby/2.2.0/net/http.rb:852:in `start'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/pact-1.59.0/lib/pact/hal/http_client.rb:55:in `block in perform_request'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/pact-1.59.0/lib/pact/retry.rb:23:in `until_****'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/pact-1.59.0/lib/pact/hal/http_client.rb:49:in `perform_request'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/pact-1.59.0/lib/pact/hal/http_client.rb:24:in `get'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/pact-1.59.0/lib/pact/hal/link.rb:49:in `get'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/pact-1.59.0/lib/pact/pact_broker/fetch_pact_uris_for_verification.rb:54:in `index'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/pact-1.59.0/lib/pact/pact_broker/fetch_pact_uris_for_verification.rb:39:in `call'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/pact-1.59.0/lib/pact/pact_broker/fetch_pact_uris_for_verification.rb:35:in `call'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/pact-1.59.0/lib/pact/pact_broker.rb:18:in `fetch_pact_uris_for_verification'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/pact-provider-verifier-1.36.0/lib/pact/provider_verifier/aggregate_pact_configs.rb:46:in `pacts_for_verification'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/pact-provider-verifier-1.36.0/lib/pact/provider_verifier/aggregate_pact_configs.rb:39:in `pacts_urls_from_broker'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/pact-provider-verifier-1.36.0/lib/pact/provider_verifier/aggregate_pact_configs.rb:26:in `call'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/pact-provider-verifier-1.36.0/lib/pact/provider_verifier/aggregate_pact_configs.rb:10:in `call'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/pact-provider-verifier-1.36.0/lib/pact/provider_verifier/app.rb:207:in `all_pact_urls'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/pact-provider-verifier-1.36.0/lib/pact/provider_verifier/app.rb:221:in `warn_empty_pact_set'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/pact-provider-verifier-1.36.0/lib/pact/provider_verifier/app.rb:40:in `call'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/pact-provider-verifier-1.36.0/lib/pact/provider_verifier/app.rb:35:in `call'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/pact-provider-verifier-1.36.0/lib/pact/provider_verifier/cli/verify.rb:49:in `verify'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/thor-1.1.0/lib/thor/command.rb:27:in `run'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/thor-1.1.0/lib/thor/invocation.rb:127:in `invoke_command'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/thor-1.1.0/lib/thor.rb:392:in `dispatch'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/thor-1.1.0/lib/thor/base.rb:485:in `start'
from /opt/pact/lib/vendor/ruby/2.2.0/gems/pact-provider-verifier-1.36.0/lib/pact/provider_verifier/cli/custom_thor.rb:17:in `start'
from /opt/pact/lib/app/pact-provider-verifier.rb:33:in `
About this issue
- Original URL
- State: closed
- Created 3 years ago
- Reactions: 1
- Comments: 28 (12 by maintainers)
That’s a relief! I don’t know when I’ll have time to address the issue properly, but at least we have a workaround in the meantime.
Might be because the standalone doesn’t execute through the bin file. I’ve pushed out a fix, and it should be in the latest standalone in a few minutes.
So I’ve pushed it out to Pact JS ( / Pact Node). Other languages will need this too.
@dimkin-eu pact4s uses Pact JVM under the hood right? I suspect it will depend on the version of Java you have and the bundled CA in that runtime. Unless I’m mistaken, Pact JVM doesn’t try and do anything special with certificates, so you will need to either upgrade your runtime or add any certificates to the JDK trust store.
@uglyog FYI in case you see a spike in activity.
Emergency release, thanks @mefellows! Try again now.
Using
@pact-foundation/pact@9.16.2and@pact-foundation/pact-node@10.13.7andPACT_DISABLE_SSL_VERIFICATION=true.Publishing pacts to the broker
pact.publishPacts()is working fine again. However verifying pactsnew Verifier().verifyProvider()is not. Getting:i cant interact with pact broker, due SSL https://pact-foundation.slack.com/archives/C5F4KFKR8/p1633068329189800
same from scala
This is what I’m seeing with a local test.
I haven’t fixed the real problem, I’ve only made it respond to
PACT_DISABLE_SSL_VERIFICATION=true