hourly cron messages re openssl cert usage error - ruby

Question

A few days ago I was building a ruby app that had to use OpenSSL to access a web page. It kept failing to connect to the web site https://regex.alf.nu, so I went to stackoverflow and after much research I concluded that my OpenSSL was out of date at version 0.9.8zc. I made the recommended changes (the details of which are provided below) and after that my app was able to read the text of the web site mentioned above.
Today I discovered that my system has been generating an error mail message almost every hour since I made these changes (beginning Sun Apr 12 08:00:01). This is the text of the latest mail:
From SamShiffman#Samuels-MBP.PK5001Z Thu Apr 16 12:00:01 2015
X-Original-To: SamShiffman
Delivered-To: SamShiffman#Samuels-MBP.PK5001Z
From: SamShiffman#Samuels-MBP.PK5001Z (Cron Daemon)
To: SamShiffman#Samuels-MBP.PK5001Z
Subject: Cron <SamShiffman#Samuels-MBP> /usr/local/Cellar/openssl-osx-ca/1.0.4/bin/openssl-osx-ca /usr/local/bin/brew
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=SamShiffman>
X-Cron-Env: <USER=SamShiffman>
X-Cron-Env: <HOME=/Users/SamShiffman>
Date: Thu, 16 Apr 2015 12:00:01 -0700 (PDT)
Usage error; try -help.
rehash failed to verify, something is wrong
check /tmp/openssl-osx-ca.f9SEDVyI/cert.pem for problems
I haven't noticed any negative effects to my MBP, but I'm a little concerned that I may still have "broken" something the other day when I made those OpenSSL updates. As far as I can tell, the cron daemon error mails started after I ran these commands:
$ rvm osx-ssl-certs status all
>Certificates for /etc/openssl/cert.pem: Old.
>Certificates for /usr/local/etc/openssl/cert.pem: Up to date.
$ rvm osx-ssl-certs update all
> Updating certificates for /etc/openssl/cert.pem: Updating certificates in '/etc/openssl/cert.pem'.
> Updated.
> Updating certificates for /usr/local/etc/openssl/cert.pem: Already up to date.
After this I still couldn't connect to the aforementioned web site. After more research I found a post in stackoverflow that referred to a tool as a possible fix. I ran:
$ brew tap raggi/ale
$ brew install openssl-osx-ca
>==> Installing openssl-osx-ca from raggi/homebrew-ale
>==> Downloading https://github.com/raggi/openssl-osx-ca/archive/1.0.4.tar.gz
>######################################################################## 100.0%
>==> make install PREFIX='/usr/local/Cellar/openssl-osx-ca/1.0.4' BREW='/usr/loca
==> Caveats
>To uninstall remove the openssl-osx-ca line from your crontab. e.g.
> (crontab -l | grep -v openssl-osx-ca) | crontab -
>==> Summary
>🍺 /usr/local/Cellar/openssl-osx-ca/1.0.4: 4 files, 16K, built in 2 seconds
$ git clone https://github.com/mislav/ssl-tools.git
$ brew link openssl --force
Linking /usr/local/Cellar/openssl/1.0.2a-1... 1543 symlinks created
$ brew install curl-ca-bundle
Error: No available formula for curl-ca-bundle
Searching formulae...
Searching taps...
$ ruby ssl-tools/doctor.rb
/Users/SamShiffman/.rvm/rubies/ruby-2.0.0-p598/bin/ruby (2.0.0-p598)
OpenSSL 1.0.2a 19 Mar 2015: /usr/local/etc/openssl
SSL_CERT_DIR=""
SSL_CERT_FILE=""
HEAD https://status.github.com:443
/Users/SamShiffman/.rvm/rubies/ruby-2.0.0-p598/lib/ruby/2.0.0/openssl/buffering.rb:175:in `sysread_nonblock': end of file reached (EOFError)
$ ruby ssl-tools/doctor.rb 'regex.alf.nu'
/Users/SamShiffman/.rvm/rubies/ruby-2.0.0-p598/bin/ruby (2.0.0-p598)
OpenSSL 1.0.2a 19 Mar 2015: /usr/local/etc/openssl
SSL_CERT_DIR=""
SSL_CERT_FILE=""
HEAD https://regex.alf.nu:443
OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed
The server presented a certificate that could not be verified:
subject: /OU=Domain Control Validated/OU=PositiveSSL Wildcard/CN=*.alf.nu
issuer: /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Domain Validation Secure Server CA
error code 20: unable to get local issuer certificate
Possible causes:
`/usr/local/etc/openssl/certs/' is empty
$ rvm osx-ssl-certs status all
Warning! PATH is not properly set up, '/Users/SamShiffman/.rvm/gems/ruby-2.0.0-p598/bin' is not at first place,
usually this is caused by shell initialization files - check them for 'PATH=...' entries,
it might also help to re-add RVM to your dotfiles: 'rvm get stable --auto-dotfiles',
to fix temporarily in this shell session run: 'rvm use ruby-2.0.0-p598'.
Certificates for /etc/openssl/cert.pem: Up to date.
Certificates for /usr/local/etc/openssl/cert.pem: Up to date.
After all this I still couldn't get the app to connect to the web site. I finally added this to my code (from a stackoverflow post) and it worked:
def get_html_string(url = #url)
uri = URI.parse(URI.encode(url.strip))
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
# http.verify_mode = OpenSSL::SSL::VERIFY_NONE
request = Net::HTTP::Get.new(uri.request_uri)
response = http.request(request)
response.body
end
Now it seems all the other steps I took leading up to this were unnecessary, but I don't know. At this point in the absence of any advice I would remove the openssl-osx-ca line from my crontab using:
(crontab -l | grep -v openssl-osx-ca) | crontab -
...but I'd like some confirmation from some code veterans who know more about this than I do.
Thank you
UPDATE 17Apr 11:00PDT
I upgraded brew, reinstalled openssl and recreated symlinks:
$ brew update
$ brew doctor
Binaries provided by keg-only formulae may override system binaries
with other strange results.
You may wish to `brew unlink` these brews:
openssl
$ brew reinstall openssl
$ brew link openssl --force
Linking /usr/local/Cellar/openssl/1.0.2a-1... 1543 symlinks created
$ brew upgrade
and the cron daemon mails stopped! Been rockin' 'n rollin' ever since.

Answer 1

I upgraded brew, reinstalled openssl and recreated symlinks:
$ brew update
$ brew doctor
Binaries provided by keg-only formulae may override system binaries
with other strange results.
You may wish to `brew unlink` these brews:
openssl
$ brew reinstall openssl
$ brew link openssl --force
Linking /usr/local/Cellar/openssl/1.0.2a-1... 1543 symlinks created
$ brew upgrade
and the cron daemon mails stopped! Been rockin' 'n rollin' ever since.