Eric Mason . net

Happy New Year!

eric — Thu, 01 Jan 2009 18:41:08 +0000

Christmas Night

eric — Fri, 26 Dec 2008 23:45:18 +0000

Thanks to Elizabeth and Jimmy and Moises and Cathie for a great party! Pictures are here.

Christmas Day

eric — Fri, 26 Dec 2008 23:40:24 +0000

Merry Christmas! Pictures are here.

Christmas Tree

eric — Thu, 04 Dec 2008 23:44:52 +0000

The tree is up!

Thanksgiving

eric — Wed, 03 Dec 2008 16:15:21 +0000

Thanksgiving was a lot of fun. We had 20 people here at our house. Check out the pictures.

Fall Photos

eric — Wed, 03 Dec 2008 16:13:34 +0000

Church Picnic

eric — Mon, 27 Oct 2008 12:14:13 +0000

First Baptist Church of Pompano Beach had our 2008 picnic yesterday at Quiet Waters Park in Deerfield Beach. Check out the pictures.

Dan and Lauren’s Wedding

eric — Wed, 15 Oct 2008 00:33:30 +0000

Congratulations to our good friends Dan Cohen and Lauren Taub! They were married October 12 in Lincon, Massachusetts.

SOAP4R and SSL: unable to get local issuer certificate

eric — Wed, 01 Oct 2008 13:16:40 +0000

After enabling SSL on a couple of apps, I got an email from one of my cron jobs telling me my SOAP API was no longer working. (This is why you always want to have an entry in /etc/aliases forwarding root’s email to an account you will read)

The error message was “unable to get local issuer certificate.” I thought, no big deal, there must be an easy way to get SOAP4R to find all the root CA certificates. Unfortunately it took a while searching Google to find the right answer, so I’m posting it here to make it easier for the next person (which just might be me next week).

It turns out SOAP4R will read a file called “soap/property” in your ruby library path (which can usually be the directory your app is in). You can place certain configuration options in this file to control how SOAP4R behaves. In this case, I needed to add


client.protocol.http.ssl_config.ca_file=/etc/ssl/certs/ca-certificates.crt

This fixed the “unable to get local issuer certificate” error right away.

There was another problem though; it was complaining about the hostname not matching the certificate. Since I’m using a wildcard certificate, I assume this means OpenSSL doesn’t respect wildcard certificates. I grudgingly added this to soap/property file


client.protocol.http.ssl_config.verify_mode=OpenSSL::SSL::VERIFY_NONE

And it’s fine now.

Multiple virtual hosts using SSL on the same IP and Port

eric — Wed, 01 Oct 2008 03:08:12 +0000

Tonight I decided to set up SSL on two internal web apps I’ve been running for a while. I have a wildcard certificate *.stockpr.com just for this purpose. Each app was originally running on a separate hostname on a single IP address on port 80.

After I started setting up SSL, I realized that I might run into trouble because Apache has always said you can’t combine NameVirtualHost and SSL. The reason for this is that the SSL session is established before the HTTP headers are sent. Since NameVirtualHost relies on the HTTP Host header, which is unavailable since it hasn’t yet been sent at the time SSL is being negotiated, Apache can only use a single SSL cert per combination of IP and port.

So my thought was this should technically not be a problem since both of my hostnames are under the same domain and I have that fancy wildcard certificate for both virtual hosts. I thought Apache just might be cool enough to send the first certificate it finds, but still respect the HTTP Host header and send the request to the right virtual host.

Guess what… Apache is indeed that cool. I now have x.stockpr.com and y.stockpr.com on the same IP and port with two different virtual hosts, sharing the same certificate.

Won’t exactly revolutionize web hosting, but it definitely made my ~~day~~ night go a little easier. (Of course if you read my last post, something else more than made up for it)