[ssl] use OpenSSL default paths by default

* do not rely on distributed cacer.pem file
* respect SSL_CERT_DIR and SSL_CERT_FILE
* working OpenSSL platform has working default paths

lib/httpclient/ssl_config.rb

@@ -146,6 +146,9 @@ def initialize(client)
       return unless SSLEnabled
       @client = client
       @cert_store = X509::Store.new
+      @cert_store.set_default_paths
+      @cacerts_loaded = working_openssl_platform?
+
       @cert_store_crl_items = []
       @client_cert = @client_key = @client_key_pass = @client_ca = nil
       @verify_mode = SSL::VERIFY_PEER | SSL::VERIFY_FAIL_IF_NO_PEER_CERT
@@ -162,7 +165,6 @@ def initialize(client)
       @options |= OpenSSL::SSL::OP_NO_SSLv3 if defined?(OpenSSL::SSL::OP_NO_SSLv3)
       # OpenSSL 0.9.8 default: "ALL:!ADH:!LOW:!EXP:!MD5:+SSLv2:@STRENGTH"
       @ciphers = CIPHERS_DEFAULT
-      @cacerts_loaded = false
     end
 
     # Sets certificate and private key for SSL client authentication.
@@ -413,6 +415,10 @@ def change_notify
       nil
     end
 
+    def working_openssl_platform?
+      File.exist?(OpenSSL::X509::DEFAULT_CERT_FILE) && Dir.exist?(OpenSSL::X509::DEFAULT_CERT_DIR)
+    end
+
     # Use 2048 bit certs trust anchor
     def load_cacerts(cert_store)
       certs = if ENV.key?('SSL_CERT_DIR'.freeze) || ENV.key?('SSL_CERT_FILE')

test/test_ssl.rb

@@ -245,6 +245,35 @@ def test_set_default_paths
     end
   end
 
+  def test_load_cacerts
+    # disables loading default openssl paths
+    default_cert_file = set_x509_const(:DEFAULT_CERT_FILE, '/invalid')
+
+    assert_raise(OpenSSL::SSL::SSLError) do
+      @client.get(@url)
+    end
+
+    setup_client
+
+    escape_env do
+      ENV['SSL_CERT_FILE'] = File.join(DIR, 'ca-chain.pem')
+      @client.get(@url)
+    end
+  ensure
+    set_x509_const(:DEFAULT_CERT_FILE, default_cert_file)
+  end
+
+  def test_default_paths
+    assert_raise(OpenSSL::SSL::SSLError) do
+      @client.get(@url)
+    end
+    escape_env do
+      ENV['SSL_CERT_FILE'] = File.join(DIR, 'ca-chain.pem')
+      setup_client
+      @client.get(@url)
+    end
+  end
+
   def test_no_sslv3
     teardown_server
     setup_server_with_ssl_version(:SSLv3)
@@ -429,6 +458,15 @@ def test_timeout
 
 private
 
+  def set_x509_const(name, value)
+    x509 = OpenSSL::X509
+    x509.module_eval do
+      original = remove_const(name)
+      const_set(name, value)
+      return original
+    end
+  end
+
   def cert(filename)
     OpenSSL::X509::Certificate.new(File.read(File.join(DIR, filename)))
   end