Rails 3:OpenSSL :: SSL :: SSLError:hostname与服务器证书不匹配

Question

尝试通过控制台发送电子邮件时,我收到此错误:

OpenSSL::SSL::SSLError: hostname was not match with the server certificate

问题是我真的不太了解证书等,或者真的如何开始对此进行故障排除,我试着做一些调查,openssl这里是返回的证书.

我不知道它是在服务器上运行的Postfix有问题,还是我的rails应用程序,任何帮助或线索都非常感谢.

~% openssl s_client -connect mail.myhostname.com:25 -starttls smtp
CONNECTED(00000003)
depth=0 /CN=myhostname
verify error:num=18:self signed certificate
verify return:1
depth=0 /CN=myhostname
verify return:1
---
Certificate chain
 0 s:/CN=myhostname
   i:/CN=myhostname
---
Server certificate
-----BEGIN CERTIFICATE-----
[...redacted...]
-----END CERTIFICATE-----
subject=/CN=myhostname
issuer=/CN=myhostname
---
No client certificate CA names sent
---
SSL handshake has read 1203 bytes and written 360 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 1024 bit
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 1AA4B8BFAAA85DA9ED4755194C50311670E57C35B8C51F9C2749936DA11918E4
    Session-ID-ctx: 
    Master-Key: 9B432F1DE9F3580DCC6208C76F96631DC5A4BC517BDBADD5F514414DCF34AC526C30687B96C5C4742E9583555A118232
    Key-Arg   : None
    Start Time: 1292985376
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
---
250 DSN

Answer 1

一个比接受的答案更好的解决方案(就安全性而言)将是:

ActionMailer::Base.smtp_settings = {
  :address              => "mail.foo.com",
  :port                 => 587,
  :domain               => "foo.com",
  :user_name            => "addy@foo.com",
  :password             => "foofoo",
  :authentication       => "plain",
  :enable_starttls_auto => true,
  :openssl_verify_mode  => 'none'
}

这样您仍将使用加密,但证书的验证将被禁用(并且您不会收到任何错误).

Answer 2

编辑:这个答案不再是最好的解决方案,可能不再有效.看到这个更安全的答案.

证书上的名称应与运行应用程序的URL匹配

没用...我在dreamhost中遇到此错误,我无法更改ssl证书.(好吧,我这样做,但费用很高.)

一种选择是禁用tls.希望你在初始化器中有这样的东西:

ActionMailer::Base.smtp_settings = {
  :address              => "mail.foo.com",
  :port                 => 587,
  :domain               => "foo.com",
  :user_name            => "addy@foo.com",
  :password             => "foofoo",
  :authentication       => "plain",
  :enable_starttls_auto => true
}

将enable starttls auto选项更改为false(如果不存在,则将其添加).

警告:这将禁用加密,这意味着您的用户名密码将以纯文本形式通过互联网

我看不出更好的方法,所以对任何答案都感兴趣.