GIT-2927: Fixed lack of updates to trusted CA lists (Fixes #2927)

[KH-Amir-TN]

Description

Many users had experienced some connectivity error with external services.
The error log is "OpenSSL::SSL::SSLError (SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate))" which indicates that an HTTPS connection was closed because of a fail during x509 certificate verification.
The issues cause is the expiration of the DST Root CA X3 Let's encrypt root certificate.
As mentioned here Let's encrypt has also a newer Root certificate ISRG Root X1 which after the expiration of DST becomes the only valid certificate.

Greenlight (GL) requires the use of http client to use some external services (BigBlueButton,OmniAuth providers,...).
Some gems (dependencies) in the GL application simplifies the communication with external APIs and comes with their own dependencies.
Some of which depends on faraday and others on httpclient.
The faraday gem has faraday-net_http which is the adapter to the Net::HTTP that is used for example by the bigbluebutton-api-ruby.
The faraday adapter by default uses the OpenSSL::X509::Store as its default store to trusted CA list.
This raises an issue for some of the users who use an old docker image since their Openssl trusted root certificates is old which leads any https connection to any server (including but not limited to BigBlueButton servers) with a x509 certificate issued by Let's encrypt to break.
Second issue happens for another subset of users who may have an up to date openssl CA list but still experience some problems (including but not limited to OmniAuth),this subset may have a problem because of the httpclient gem that uses an old (from 2015) Mozilla CA list.

Testing Steps

1. Checked all the http client gems and the gems that depends on it.
2. Tested each http client gem in isolation.
3. Found hat HTTPClient by default loads the cacert.pem [on non JRuby runtimes] (the default in the repo is outdated) included in its lib/httpclient and falls back if configured to the OpenSSL store but any update in execution to its stores won't have an effect because it cashes it on runtime.
4. Found that Faraday adapter to Net::HTTP uses the OpenSSL as its store by default and cashes it on runtime.

Solution

For HTTPClient: we fetch the latest Mozilla cacert.pem securely on docker image build.
For Net::HTTP: we enforce the update of the openssl certs on image build.

Screenshots (if appropriate):

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

[sripathroy]

Migration from Greenlight Customized 2.5 to Greenlight 3 Failed

Steps done

rake Migration tasks file was added
While migrating users got this error
OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed (certificate has expired)

RUBY_VERSION=2.5.1
RUBYGEMS_VERSION=2.7.7
BUNDLER_VERSION=1.16.6
VERSION_CODE=v2