diff --git a/lib/httparty.rb b/lib/httparty.rb index 021c27a1..16ad5042 100644 --- a/lib/httparty.rb +++ b/lib/httparty.rb @@ -353,6 +353,11 @@ def pkcs12(p12_contents, password) default_options[:p12_password] = password end + # Allow using a full certificate chain (http.extra_chain_cert) + def extra_chain_cert(value = false) + default_options[:extra_chain_cert] = value + end + # Override the way query strings are normalized. # Helpful for overriding the default rails normalization of Array queries. # diff --git a/lib/httparty/connection_adapter.rb b/lib/httparty/connection_adapter.rb index 262016fb..71aa7e5c 100644 --- a/lib/httparty/connection_adapter.rb +++ b/lib/httparty/connection_adapter.rb @@ -231,6 +231,12 @@ def attach_ssl_certificates(http, options) if options[:ssl_version] && http.respond_to?(:ssl_version=) http.ssl_version = options[:ssl_version] end + + # Include full certificate chain + # Only Ruby 3.0+ + if options[:extra_chain_cert] && options[:p12] && http.respond_to?(:extra_chain_cert=) + http.extra_chain_cert = [p12.certificate] + p12.ca_certs + end end end end diff --git a/spec/httparty/connection_adapter_spec.rb b/spec/httparty/connection_adapter_spec.rb index de386f87..02ce9ddf 100644 --- a/spec/httparty/connection_adapter_spec.rb +++ b/spec/httparty/connection_adapter_spec.rb @@ -628,6 +628,24 @@ expect(subject.verify_mode).to eq(OpenSSL::SSL::VERIFY_NONE) end end + + context "when using extra_chain_cert and p12" do + let(:options) { { p12: p12, p12_password: "password", extra_chain_cert: true } } + + before { allow(pkcs12).to receive(:ca_certs).and_return([double("OpenSSL::X509::Certificate")]) } + + it "does not set extra_chain_cert on unsupported ruby versions" do + if !(subject.respond_to?(:extra_chain_cert=)) + expect(subject).to_not receive(:extra_chain_cert=) + end + end + + it "sets extra_chain_cert on http object in Ruby 3.0+" do + if subject.respond_to?(:extra_chain_cert=) + expect(subject.extra_chain_cert).to eq([cert] + pkcs12.ca_certs) + end + end + end end context "when scheme is not https" do diff --git a/spec/httparty_spec.rb b/spec/httparty_spec.rb index b6055298..915ae9dc 100644 --- a/spec/httparty_spec.rb +++ b/spec/httparty_spec.rb @@ -35,6 +35,13 @@ end end + describe "extra_chain_cert" do + it 'should set the extra_chain_cert option' do + @klass.extra_chain_cert true + expect(@klass.default_options[:extra_chain_cert]).to eq(true) + end + end + describe 'ssl_version' do it 'should set the ssl_version content' do @klass.ssl_version :SSLv3