Skip to content

Commit c67f786

Browse files
author
Nathan Sutton
committed
Update the documentation to reflect the ssl cert bundling change.
1 parent 534cb59 commit c67f786

File tree

1 file changed

+25
-1
lines changed

1 file changed

+25
-1
lines changed

README.markdown

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,12 @@ Tested on the following versions of Ruby:
1515
* Rubinius 2.0.0dev
1616
* jRuby 1.6.5
1717

18+
## 2.5 WARNING!!!
19+
20+
Version 2.5 brings a single, significant change to the gem which you should be aware of:
21+
22+
* __The Zencoder SSL CA chain is no longer bundled.__ Our cert is expiring and the necessary file may change in the future. You can now specify the CA file or CA path along with the request.
23+
1824
## v2.4 WARNING!!!
1925

2026
Version 2.4 brings some significant changes to the gem, ones which you should be aware of:
@@ -335,7 +341,25 @@ Zencoder::Job.create({:input => 's3://bucket/key.mp4'}, {:timeout => 1000})
335341

336342
### SSL Verification
337343

338-
We will use our bundled SSL CA chain for SSL peer verification which should almost always work without a hitch. However, if you'd like to skip SSL verification you can pass an option in the secondary options hash.
344+
SSL verification using the default Net::HTTP backend requires that your ruby be appropriately configured with up to date path to a cert bundle on your system or by specifying the a CA file or CA path when sending requests.
345+
346+
```ruby
347+
Zencoder::Job.create({:input => 's3://bucket/key.mp4'}, {:ca_path => "/path/to/certs/"})
348+
# or
349+
Zencoder::Job.create({:input => 's3://bucket/key.mp4'}, {:ca_file => "/path/to/certs/zen.crt"})
350+
```
351+
352+
Alternatively you can add it to the default options.
353+
354+
```ruby
355+
Zencoder::HTTP.default_options.merge!(:ca_path => "/path/to/certs/")
356+
# or
357+
Zencoder::HTTP.default_options.merge!(:ca_file => "/path/to/certs/zen.crt")
358+
```
359+
360+
You can get a CA bundle from [the curl website](http://curl.haxx.se/docs/caextract.html), but it is recommended that you use your system's package manager to install these certs and keep them up to date.
361+
362+
However, if you'd like to skip SSL verification you can pass an option in the secondary options hash.
339363

340364
**NOTE: WE HIGHLY DISCOURAGE THIS! THIS WILL LEAVE YOU VULNERABLE TO MAN-IN-THE-MIDDLE ATTACKS!**
341365

0 commit comments

Comments
 (0)