How do I verify an X.509 certificate with Ruby OpenSSL? - ruby

Question

I'm trying to verify an Amazon SNS message. It comes signed by an X.509 certificate, and provides a URL for the certificate.
I have no problems checking the signature against the certificate, but how do I know the certificate is valid?
I've seen a variety of places that show how to get OpenSSL to validate certificates used on an SSLSocket, but I can't see how to just check to see if a certificate is valid.
I suppose I could "shell" out to run something like openssl x509 -in <file> -text -noout, and parse the output, but that seems like a lame solution.
So:
cert = OpenSSL::X509::Certificate.new(Faraday.get(cert_url).body)
# now what?

Answer 1

Well, a weekend of struggling and it's now clearer.
The basic sequence is to construct an OpenSSL::X509::Store, and populate it with the certs of trusted CAs.
store = OpenSSL::X509::Store.new
store.set_default_paths # populates with some 'standard' ones
Then, I can test the validity of a certificate with:
store.verify(cert)
An added wrinkle, in my case (verifying SNS notifications) is that the certificate I'm trying to validate isn't directly signed by a trusted CA, so I need an additional level added.
I've been able to check the full chain by fetching the certificate that signed the SNS cert by searching the web. So the final code ends up being something like this:
def valid?(cert)
store.verify(cert)
end
def store
#store ||= OpenSSL::X509::Store.new.tap do |store|
store.set_default_paths
store.add_cert(OpenSSL::X509::Certificate.new(File.read('SNS_issuer_cert.cer')))
end
end