Ruby Issue Tracking System

10/09/2025

10:34 AM Ruby Bug #21631 (Closed): Backport openssl gem bugfix releases

Thanks for taking care of this!
@hsbt has merged it into ruby_3_2 at commit:c38243e2c4e874d67b63431f9489f47ddfecdefd rhenium (Kazuki Yamaguchi)

05:00 AM Ruby Revision c38243e2 (git): [ruby/openssl] ssl: remove OpenSSL::X509::V_FLAG_CRL_CHECK_ALL from the default store

With OpenSSL 3.6.0, it causes nearly every certificate verification to
fail with the message "certificate verify failed (unable to get
certificate CRL)" because the CRLs are typically unavailable in the
default store used by OpenSSL::SSL... rhenium (Kazuki Yamaguchi)

10/08/2025

02:27 PM Ruby Revision a8b34d9a (git): [ruby/openssl] ssl: allow SSLContext#set_params to be used from non-main Ractors

Freeze OpenSSL::SSL::SSLContext::DEFAULT_PARAMS so that it becomes
Ractor-shareable.
Also, prepare a new OpenSSL::X509::Store in Ractor-local storage, if
called from a non-main Ractor. OpenSSL::X509::Store currently is not a
shareable o... rhenium (Kazuki Yamaguchi)

01:59 PM Ruby Revision ea79fe22 (git): [ruby/openssl] ssl: use SSL_CTX_set_dh_auto() by default

Rely on OpenSSL's builtin DH parameters for TLS 1.2 and earlier instead
of providing a default SSLContext#tmp_dh_callback proc.
SSL_CTX_set_dh_auto() has been available since OpenSSL 1.1.0.
The parameters can still be overridden by spec... rhenium (Kazuki Yamaguchi)

01:59 PM Ruby Revision e4f12808 (git): [ruby/openssl] ssl: refactor tmp_dh_callback handling

tmp_dh_callback no longer has a default value. It also no longer has to
share code with tmp_ecdh_callback, which has been removed in v3.0.0.
https://github.com/ruby/openssl/commit/b7cde6df2a rhenium (Kazuki Yamaguchi)

01:59 PM Ruby Revision 810b3a40 (git): [ruby/openssl] provider: load "default" provider in test_openssl_legacy_provider

Update the test case to explicitly load both the "default" and the
"legacy" providers.
Currently, the "default" provider as a side effect by the
OpenSSL::PKey::DH.new call in lib/openssl/ssl.rb. It will be cleaned up
in a following patc... rhenium (Kazuki Yamaguchi)

01:59 PM Ruby Revision 8dfe5403 (git): [ruby/openssl] ssl: fix extconf.rb check for SSL_CTX_set0_tmp_dh_pkey()

Check for the function we actually use. Both SSL_set0_tmp_dh_pkey() and
SSL_CTX_set0_tmp_dh_pkey() were added in OpenSSL 3.0.
https://github.com/ruby/openssl/commit/a9b6a64e5f rhenium (Kazuki Yamaguchi)

12:46 AM Ruby Bug #21629: Ruby-3.4.7 prints -Wdefault-const-init-field-unsafe warnings on clang / llvm 21

The attached `ruby-log.txt` seems to show the build was successful, but the test case meant to catch this kind of problem failed, as intended:
```
*** Following extensions are not compiled:
-test-/public_header_warnings:
Could not... rhenium (Kazuki Yamaguchi)

10/06/2025

08:02 AM Ruby Revision 33808e0f (git): [ruby/openssl] Bump version number to 4.0.0.pre

https://github.com/ruby/openssl/commit/64f4aae6bd rhenium (Kazuki Yamaguchi)

07:56 AM Ruby Revision 224c1787 (git): [ruby/openssl] Ruby/OpenSSL 3.3.1

https://github.com/ruby/openssl/commit/2b88a6d444 rhenium (Kazuki Yamaguchi)