{"record":{"id":"c0cfa8ef6ccf1152","repo":"we-promise/sure","slug":"ssl-warning-ssl-verification-is-disabled","errorCode":null,"errorMessage":"[SSL] WARNING: SSL verification is DISABLED","messagePattern":"\\[SSL\\] WARNING: SSL verification is DISABLED","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"config/initializers/00_ssl.rb","lineNumber":202,"sourceCode":"  # Logs SSL configuration summary at startup\n  #\n  # @param ssl_config [ActiveSupport::OrderedOptions] SSL configuration\n  def log_ssl_configuration(ssl_config)\n    if ssl_config.debug\n      Rails.logger.info(\"[SSL] Debug mode enabled - verbose SSL logging active\")\n    end\n\n    if ssl_config.ca_file.present?\n      if ssl_config.ca_file_valid\n        Rails.logger.info(\"[SSL] Custom CA certificate configured and validated: #{ssl_config.ca_file}\")\n      else\n        Rails.logger.error(\"[SSL] Custom CA certificate configured but invalid: #{ssl_config.ca_file_error}\")\n      end\n    end\n\n    unless ssl_config.verify\n      Rails.logger.warn(\"[SSL] \" + \"=\" * 60)\n      Rails.logger.warn(\"[SSL] WARNING: SSL verification is DISABLED\")\n      Rails.logger.warn(\"[SSL] This is insecure and should only be used for development/testing\")\n      Rails.logger.warn(\"[SSL] Set SSL_VERIFY=true or remove the variable for production\")\n      Rails.logger.warn(\"[SSL] \" + \"=\" * 60)\n    end\n\n    if ssl_config.debug\n      Rails.logger.info(\"[SSL] Configuration summary:\")\n      Rails.logger.info(\"[SSL]   - SSL verification: #{ssl_config.verify ? 'ENABLED' : 'DISABLED'}\")\n      Rails.logger.info(\"[SSL]   - Custom CA file: #{ssl_config.ca_file || 'not configured'}\")\n      Rails.logger.info(\"[SSL]   - CA file valid: #{ssl_config.ca_file_valid}\")\n      Rails.logger.info(\"[SSL]   - Combined CA bundle: #{ssl_config.combined_ca_bundle || 'not created'}\")\n      Rails.logger.info(\"[SSL]   - SSL_CERT_FILE: #{ENV['SSL_CERT_FILE'] || 'not set'}\")\n    end\n  end\nend\n\n# Configure SSL settings\nRails.application.configure do","sourceCodeStart":184,"sourceCodeEnd":220,"githubUrl":"https://github.com/we-promise/sure/blob/e69894adb92547273377398c15f45c979cd9416a/config/initializers/00_ssl.rb#L184-L220","documentation":"Startup warning block from config/initializers/00_ssl.rb (line 202) logged when ssl_config.verify is false, i.e. SSL certificate verification is disabled globally. The initializer prints a bordered WARNING stating this is insecure and only for development/testing, and tells you to set SSL_VERIFY=true or remove the variable for production. With verification off, TLS connections accept any certificate — man-in-the-middle attacks become possible against provider/bank API calls.","triggerScenarios":"Deploying or booting any environment with SSL_VERIFY=false (or an equivalent falsy setting) in the environment; usually set during development against self-signed proxies and accidentally carried into production config.","commonSituations":"Corporate MITM proxy dev setups copying their .env into staging/prod; container images baking SSL_VERIFY=false; testing with tools like mitmproxy and forgetting to revert.","solutions":["In production, remove SSL_VERIFY=false from the environment (or set SSL_VERIFY=true) and restart; the warning block disappears.","If the reason was a self-signed internal service, configure its CA via the custom CA file path instead of disabling verification.","Audit deploy manifests (compose files, Helm values, systemd Environment=) for lingering SSL_VERIFY.","Treat any production appearance of this warning as a security incident: credentials transmitted to providers were potentially interceptable."],"exampleFix":"// before\nSSL_VERIFY=false  # prod env -> warning, all TLS unverified\n\n// after\n# remove the var (default verifies), or:\nSSL_VERIFY=true\n# for internal self-signed services use the custom CA option instead","handlingStrategy":"validation","validationCode":"if Rails.env.production? && ENV['SSL_VERIFY'].to_s.casecmp('false').zero?\n  abort 'SSL_VERIFY=false is forbidden in production'\nend","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep SSL_VERIFY=false only in local dev env files that never reach deploy manifests.","Use the custom CA path for self-signed internal services instead of disabling verification.","Grep deploy config (compose, Helm, systemd) for SSL_VERIFY as part of release checks."],"tags":["ssl","tls","security","configuration","startup-warning"],"backgroundTag":"ssl-verification-disabled","analyzedSha":"e69894adb92547273377398c15f45c979cd9416a","analyzedAt":"2026-08-21T18:22:41.165Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}