Repository navigation
Net::HTTP doesn't allow to set SSL options #139
Description
Activity
Running into this same issue as well with the upgrade to OpenSSL 3 for our Ruby installation.
As our client gems rely onnet-http, this issue causes a lot ofSSL_READerrors to appear in our client side, despite the server logs on the calling side show that the response has been sent to the client.I can confirm that the workaround as a monkey patch definitely works and restores functionality, but setting this as a global option isn't ideal either. With the upgrades everywhere coming for OpenSSL 3, it would be nice to see
net-httpaccomodate either the configuration options for this, or by default start handling this behavior.As a simpler alternative to passing a
SSLContextinstance I've opened #218 which implements a #ssl_options attribute, which would make it fairly straightforward to specify options per connection instead of globally:http.ssl_options = OpenSSL::SSL::OP_IGNORE_UNEXPECTED_EOF
Is this happening? Or is there another way to do it?
- marked Clean connection closure via SSL_ERROR_ZERO_RETURN incorrectly treated as fatal error openssl#1063 as a duplicate of this issue
on Jun 21, 2026 SSLContext#optionsoften has a non-zero value by default and it's usually desirable to keep existing options. This makes it unsuitable for simply adding toSSL_ATTRIBUTES. (And we probably don't want a method namedNet::HTTP#options.)I think exposing the
SSLContextobject to users is a better approach: #303require 'uri' require 'net/http' uri = URI('https://www.moviesubtitles.org/search.php?q=paris+new+york') http = Net::HTTP.new(uri.host, 443) http.use_ssl = true http.ssl_context.options |= OpenSSL::SSL::OP_IGNORE_UNEXPECTED_EOF res = http.send_request('GET', uri.request_uri) puts res.body.gsub(/(?<=>)/, "\n").split("\n").last(10)
This does indeed work! Assuming this require forms like above or below.
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) do |http| http.ssl_context.options |= OpenSSL::SSL::OP_IGNORE_UNEXPECTED_EOF http.get(uri.request_uri) end
Would an alternative solution be to throw the exception as before, but still return the body, so that the developer may rescue and get the body? This would make for more concise code and access to convenience functions.
PS! Had a couple of
/protocol.rb:241:in 'Net::BufferedIO#rbuf_fill': end of file reached (EOFError)happening (on a different site), but these might be a different issue.As a (ostensibly related) side note, shouldn't
http.use_ssl = true(and even443) be implied by now?- Assume https/SSL for everything
- Require dev to explicitly downgrade to http
- Automatically downgrade for
- localhost / .localhost / .local (127.0.0.0/8)
- private network (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
More than 99 percent of the top one hundred thousand websites support HTTPS. Non SSL websites are disproportionately concentrated among low traffic, small scale, or legacy sites.
Context
Since OpenSSL 3.x, when a server close the TCP connection without first calling
SSL_shutdown, the SSL client now error withSSL_read: unexpected eof while reading.In OpenSSL 1.x, the client wouldn't mind and would behave like if the connection was cleanly closed.
To restore the 1.x behavior, you can set a specific options:
Problem
The issue is that
Net::HTTPonly allow to set specific fields on theSSLContextobject, andoptionsis not one of them.Workaround
The issue can be worked around by changing the default options globally:
However this impact all SSL connections, not just the ones that need it.
Solution
Not sure what the best API would be. But it would be great if we could directly pass a
SSLContextinstance toNet::HTTP, so that we're not limited on the SSL configuration.