Skip to content

Conversation

@rhenium
Copy link
Member

@rhenium rhenium commented Dec 5, 2025

An OpenSSL function sometimes puts more than one error entry into the thread-local error queue. We currently use the last, the highest level entry for generating the exception message. The rest is silently dropped unless OpenSSL.debug is set to true, which makes it print to rb_warn().

Capture all current OpenSSL error queue contents into OpenSSL::OpenSSLError#errors in ossl_make_error(), and extend OpenSSL::OpenSSLError#detailed_message to include the information.

An example:

$ ruby -Ilib -ropenssl -e'OpenSSL::X509::ExtensionFactory.new.create_ext("a", "b")'
-e:1:in 'OpenSSL::X509::ExtensionFactory#create_ext': a = b: error in extension (name=a, value=b) (OpenSSL::X509::ExtensionError)
OpenSSL error queue reported 2 errors:
error:11000082:X509 V3 routines:do_ext_nconf:unknown extension name
error:11000080:X509 V3 routines:X509V3_EXT_nconf_int:error in extension (name=a, value=b)
        from -e:1:in '<main>'

Closes #312.

An OpenSSL function sometimes puts more than one error entry into the
thread-local error queue. We currently use the last, the highest level
entry for generating the exception message. The rest is silently
dropped unless OpenSSL.debug is set to true, which makes it print to
rb_warn().

Capture all current OpenSSL error queue contents into
OpenSSL::OpenSSLError#errors in ossl_make_error(), and extend
OpenSSL::OpenSSLError#detailed_message to include the information.

An example:

    $ ruby -Ilib -ropenssl -e'OpenSSL::X509::ExtensionFactory.new.create_ext("a", "b")'
    -e:1:in 'OpenSSL::X509::ExtensionFactory#create_ext': a = b: error in extension (name=a, value=b) (OpenSSL::X509::ExtensionError)
    OpenSSL error queue reported 2 errors:
    error:11000082:X509 V3 routines:do_ext_nconf:unknown extension name
    error:11000080:X509 V3 routines:X509V3_EXT_nconf_int:error in extension (name=a, value=b)
            from -e:1:in '<main>'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

how to return SSL error stack

1 participant