we-promise/sure · warning

[SSL] WARNING: SSL verification is DISABLED

Error message

[SSL] WARNING: SSL verification is DISABLED

What it means

Startup warning block from config/initializers/00_ssl.rb (line 202) logged when ssl_config.verify is false, i.e. SSL certificate verification is disabled globally. The initializer prints a bordered WARNING stating this is insecure and only for development/testing, and tells you to set SSL_VERIFY=true or remove the variable for production. With verification off, TLS connections accept any certificate — man-in-the-middle attacks become possible against provider/bank API calls.

Source

Thrown at config/initializers/00_ssl.rb:202

  # Logs SSL configuration summary at startup
  #
  # @param ssl_config [ActiveSupport::OrderedOptions] SSL configuration
  def log_ssl_configuration(ssl_config)
    if ssl_config.debug
      Rails.logger.info("[SSL] Debug mode enabled - verbose SSL logging active")
    end

    if ssl_config.ca_file.present?
      if ssl_config.ca_file_valid
        Rails.logger.info("[SSL] Custom CA certificate configured and validated: #{ssl_config.ca_file}")
      else
        Rails.logger.error("[SSL] Custom CA certificate configured but invalid: #{ssl_config.ca_file_error}")
      end
    end

    unless ssl_config.verify
      Rails.logger.warn("[SSL] " + "=" * 60)
      Rails.logger.warn("[SSL] WARNING: SSL verification is DISABLED")
      Rails.logger.warn("[SSL] This is insecure and should only be used for development/testing")
      Rails.logger.warn("[SSL] Set SSL_VERIFY=true or remove the variable for production")
      Rails.logger.warn("[SSL] " + "=" * 60)
    end

    if ssl_config.debug
      Rails.logger.info("[SSL] Configuration summary:")
      Rails.logger.info("[SSL]   - SSL verification: #{ssl_config.verify ? 'ENABLED' : 'DISABLED'}")
      Rails.logger.info("[SSL]   - Custom CA file: #{ssl_config.ca_file || 'not configured'}")
      Rails.logger.info("[SSL]   - CA file valid: #{ssl_config.ca_file_valid}")
      Rails.logger.info("[SSL]   - Combined CA bundle: #{ssl_config.combined_ca_bundle || 'not created'}")
      Rails.logger.info("[SSL]   - SSL_CERT_FILE: #{ENV['SSL_CERT_FILE'] || 'not set'}")
    end
  end
end

# Configure SSL settings
Rails.application.configure do

View on GitHub (pinned to e69894adb9)

Solutions

1. In production, remove SSL_VERIFY=false from the environment (or set SSL_VERIFY=true) and restart; the warning block disappears.
2. If the reason was a self-signed internal service, configure its CA via the custom CA file path instead of disabling verification.
3. Audit deploy manifests (compose files, Helm values, systemd Environment=) for lingering SSL_VERIFY.
4. Treat any production appearance of this warning as a security incident: credentials transmitted to providers were potentially interceptable.

Example fix

// before
SSL_VERIFY=false  # prod env -> warning, all TLS unverified

// after
# remove the var (default verifies), or:
SSL_VERIFY=true
# for internal self-signed services use the custom CA option instead

if Rails.env.production? && ENV['SSL_VERIFY'].to_s.casecmp('false').zero?
  abort 'SSL_VERIFY=false is forbidden in production'
end

When it happens

Trigger: Deploying or booting any environment with SSL_VERIFY=false (or an equivalent falsy setting) in the environment; usually set during development against self-signed proxies and accidentally carried into production config.

Common situations: Corporate MITM proxy dev setups copying their .env into staging/prod; container images baking SSL_VERIFY=false; testing with tools like mitmproxy and forgetting to revert.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• [SSL] Could not find system CA bundle - using custom CA only
• [SSL] Could not create combined CA bundle, using custom CA o
• [SECURITY] ActiveRecord Encryption is NOT configured. Sensit
• Auth config not loaded: #{e.class} - #{e.message}
• [OmniAuth] Skipping OIDC provider '#{name}' - missing requir

AI-assisted analysis of we-promise/sure@e69894adb9 (2026-08-21). Data as JSON: /api/errors/c0cfa8ef6ccf1152. Report an issue: GitHub.