{"action":"opened","issue":{"url":"https://api.github.com/repos/bundler/bundler/issues/5687","repository_url":"https://api.github.com/repos/bundler/bundler","labels_url":"https://api.github.com/repos/bundler/bundler/issues/5687/labels{/name}","comments_url":"https://api.github.com/repos/bundler/bundler/issues/5687/comments","events_url":"https://api.github.com/repos/bundler/bundler/issues/5687/events","html_url":"https://github.com/bundler/bundler/issues/5687","id":232364296,"number":5687,"title":"TLS troubleshooting and migration guide","user":{"login":"indirect","id":78,"avatar_url":"https://avatars2.githubusercontent.com/u/78?v=3","gravatar_id":"","url":"https://api.github.com/users/indirect","html_url":"https://github.com/indirect","followers_url":"https://api.github.com/users/indirect/followers","following_url":"https://api.github.com/users/indirect/following{/other_user}","gists_url":"https://api.github.com/users/indirect/gists{/gist_id}","starred_url":"https://api.github.com/users/indirect/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/indirect/subscriptions","organizations_url":"https://api.github.com/users/indirect/orgs","repos_url":"https://api.github.com/users/indirect/repos","events_url":"https://api.github.com/users/indirect/events{/privacy}","received_events_url":"https://api.github.com/users/indirect/received_events","type":"User","site_admin":false},"labels":[{"id":67203981,"url":"https://api.github.com/repos/bundler/bundler/labels/status:%20working","name":"status: working","color":"fef2c0","default":false},{"id":210302815,"url":"https://api.github.com/repos/bundler/bundler/labels/type:%20documentation","name":"type: documentation","color":"bfe5bf","default":false}],"state":"open","locked":false,"assignee":{"login":"rubymorillo","id":3386562,"avatar_url":"https://avatars3.githubusercontent.com/u/3386562?v=3","gravatar_id":"","url":"https://api.github.com/users/rubymorillo","html_url":"https://github.com/rubymorillo","followers_url":"https://api.github.com/users/rubymorillo/followers","following_url":"https://api.github.com/users/rubymorillo/following{/other_user}","gists_url":"https://api.github.com/users/rubymorillo/gists{/gist_id}","starred_url":"https://api.github.com/users/rubymorillo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rubymorillo/subscriptions","organizations_url":"https://api.github.com/users/rubymorillo/orgs","repos_url":"https://api.github.com/users/rubymorillo/repos","events_url":"https://api.github.com/users/rubymorillo/events{/privacy}","received_events_url":"https://api.github.com/users/rubymorillo/received_events","type":"User","site_admin":false},"assignees":[{"login":"rubymorillo","id":3386562,"avatar_url":"https://avatars3.githubusercontent.com/u/3386562?v=3","gravatar_id":"","url":"https://api.github.com/users/rubymorillo","html_url":"https://github.com/rubymorillo","followers_url":"https://api.github.com/users/rubymorillo/followers","following_url":"https://api.github.com/users/rubymorillo/following{/other_user}","gists_url":"https://api.github.com/users/rubymorillo/gists{/gist_id}","starred_url":"https://api.github.com/users/rubymorillo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rubymorillo/subscriptions","organizations_url":"https://api.github.com/users/rubymorillo/orgs","repos_url":"https://api.github.com/users/rubymorillo/repos","events_url":"https://api.github.com/users/rubymorillo/events{/privacy}","received_events_url":"https://api.github.com/users/rubymorillo/received_events","type":"User","site_admin":false}],"milestone":null,"comments":0,"created_at":"2017-05-30T19:58:48Z","updated_at":"2017-05-30T19:58:48Z","closed_at":null,"body":"As part of [the Fastly TLS deprecation][1], RubyGems.org is going to lose the ability to allow TLS v1.0 and v1.1. A few weeks ago, Fastly disabled TLS v1.0 and v1.1 for us as part of their plan, and we discovered that _a lot_ of Ruby users still aren't able to use TLS v1.2 yet. Unfortunately, the older versions of TLS have known problems that make them insecure.\r\n\r\nWe would like to migrate everyone, and Fastly is going to force all of their customers to migrate no later than April 2018. We [plan to disable older TLS versions in January 2018][2], with the goal of releasing a new version with a warning that explains how to fix the problem it at least 3 months in advance.\r\n\r\nIn order to be able to use TLS v1.2, users need to be using OpenSSL version 1.0.1 or later (first released March 14, 2012). Then, they need to make sure that they are using a version of Ruby that includes OpenSSL support, and binds against OpenSSL 1.0.1 or later. Unfortunately, there are a lot of ways that can be messed up, and problems with OpenSSL versions can interact with problems with certificates, sometimes making it hard to tell exactly where the problem lies.\r\n\r\nI am currently imagining that our explanation of the problem and possible solutions will take the form of a guide on [the Bundler website](https://bundler.io). I'm hoping we can create a page that explains what the problem is, why we are changing things, and how to update the OpenSSL library and/or Ruby to fix the problem. Then, we can link to that page from the warning that we print when Bundler is used on a version of Ruby that will not be able to connect to RubyGems.org after the change.\r\n\r\nSeparate from the migration to TLS v1.2, but related in that it causes a similar problem is general SSL and certificate issues. On the whole, even without the TLS version change, these have been the source of a lot of trouble. rubygems/rubygems#1758 is a great example of the kinds of problems that people have with SSL in general, and the kinds of things that they need to do to get it working again. We have [a RubyGems guide to solving SSL problems][3], but it seems to be insufficient based on how many people still open new issues or comment on old ones like the ticket I linked above. The source for the RubyGems SSL guide is in the rubygems/guides repo [in this file][4].\r\n\r\nAnother super helpful resource that I refer to a lot while troubleshooting SSL problems with Ruby is [Mislav's guide to Ruby and SSL](https://mislav.net/2013/07/ruby-openssl/). It's a good explanation of the kinds of problems that Ruby devs often see with SSL (although it doesn't mention the TLS version migration, because that is a newer problem than the guide). He also wrote [a Ruby to help debug SSL issues](https://github.com/mislav/ssl-tools), which is another helpful resource.\r\n\r\nIn the Bundler guide, we'll probably need to not only explain the TLS v1.2 migration, but also include most of the information from the RubyGems guide (and even additional information above and beyond that guide, like what users reported in that ticket). I'm sure users having any kind of SSL problem will end up checking out our guide, and if we can successfully help them solve their own problems, that will be a huge win.\r\n\r\nI'm sure you'll have questions once you start tackling this, feel free to ask here or ping me in Slack for more details. Thanks!\r\n\r\n[1]: https://www.fastly.com/blog/phase-two-our-tls-10-and-11-deprecation-plan\r\n[2]: https://github.com/bundler/bundler/pull/5638\r\n[3]: http://guides.rubygems.org/ssl-certificate-update/\r\n[4]: https://github.com/rubygems/guides/blob/gh-pages/ssl-certificate-update.md"}}
{"actor":{"display_login":"indirect"}}