Question

I have tried everything to solve this issue and can’t get anything to work. I have uninstalled everything and reinstalled. Still no love. Here is the error I get when trying to connect to the Evernote API.

OpenSSL::SSL::SSLError: SSL_connect SYSCALL returned=5 errno=0 state=SSLv2/v3 read server hello A

I am running:
RVM 1.15.9
Ruby 1.9.3-p194
OpenSSL 1.0.1c
Rails 3.2.8
Homebrew 0.9.3

I have tried literally everything. Followed this guide http://railsapps.github.com/openssl-certificate-verify-failed.html

Trying to use the Evernote API, that is how this all started. cURL works fine pinging a HTTPS address.
Cheers.

Answer 1

Could be a problem between SSL v2 and v3.

Command line diagnostic:

To diagnose this, try this on your command line:

$ openssl s_client -connect sandbox.evernote.com:443

The command may fail like this:

CONNECTED(00000003)
140386475906720:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure
...

Now try it with just SSL3:

openssl s_client -no_tls1 -no_ssl2 -ssl3 -connect  sandbox.evernote.com:443

You want to get a result like this:

CONNECTED(00000003)
depth=2 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network
...

If the first command fails, and the second command succeeds, then the problem is very likely SSL2 vs. SSL3.

Ruby diagnostic:

#!/usr/bin/env ruby                                                                                                                                                                                                                                                              
require 'net/http'
uri = URI.parse('https://sandbox.evernote.com/')
req = Net::HTTP::Get.new(uri.path)
sock = Net::HTTP.new(uri.host, 443)
sock.use_ssl = true

# Try with default SSL                                                                                                                                                                                                                                                           
begin
  sock.start do |http|
    response = http.request(req)
  end
  puts "success with SSL default"
rescue
  puts "failure with SSL default"
end

# Try with just SSL3                                                                                                                                                                                                                                                             
sock.ssl_version="SSLv3"
begin
  sock.start do |http|
    response = http.request(req)
  end
  puts "success with SSLv3"
rescue
  puts "failure with SSLv3"
end

How to fix it:

WARNING: this is a hack. Use at your own risk. If anyone finds a better way to do this, please comment here.

Patch HTTP.new to force it to always use SSLv3

require 'net/http'
module Net
  class HTTP < Protocol
    def HTTP.new(address, port = nil, p_addr = nil, p_port = nil, p_user = nil, p_pass = nil)
      socket = Proxy(p_addr, p_port, p_user, p_pass).newobj(address, port)
      socket.ssl_version = "SSLv3"
      socket
    end
  end
end

uri = URI.parse('https://sandbox.evernote.com/')
req = Net::HTTP::Get.new(uri.path)
sock = Net::HTTP.new(uri.host, 443)
sock.use_ssl = true

# Try with default SSL                                                                                                                                                                                                                                                           
begin
  sock.start do |http|
    response = http.request(req)
  end
  puts "success with SSL default"
rescue
  puts "failure with SSL default"
end