> Ruby > Ruby for Scripting and Automation > Forge Secure Connections: Ruby's SSL/TLS Certificate Mastery

Ruby for Scripting and Automation

Forge Secure Connections: Ruby's SSL/TLS Certificate Mastery

Forge Secure Connections: Ruby's SSL/TLS Certificate Mastery

In an interconnected digital fabric, security is paramount. Every interaction, every data exchange, hinges on trust and verifiable identities. For Ruby developers operating at the vanguard of scripting and automation, mastering secure communication protocols is not merely an advantage; it is a fundamental requirement. This definitive guide decodes the complexities of handling SSL/TLS certificates within your Ruby scripts, transforming a potential vulnerability into an impenetrable strength.

We embark on an exploration of programmatic certificate management, equipping you with the strategies to establish, validate, and troubleshoot secure connections with surgical precision. Learn to navigate the intricate landscape of certificate authorities, trust stores, and validation mechanisms. For those actively engaged in automating infrastructure and data workflows, mastering secure communication protocols is a non-negotiable skill, extending the utility of your Ruby scripting prowess for DevOps and data tasks. Activate this knowledge to engineer robust, secure applications and scripts, ensuring data integrity and user confidence in every transaction.

Published on:

Activate SSL/TLS Fundamentals in Ruby Scripts

We initiate our journey by establishing the foundational concepts of SSL/TLS within the Ruby ecosystem. Secure Sockets Layer (SSL) and its successor, Transport Layer Security (TLS), are cryptographic protocols engineered to secure communication over a computer network. When your Ruby script connects to an HTTPS endpoint, it engages in a complex handshake process. This involves the server presenting its digital certificate, which your script must then validate against its trust store. This initial validation confirms the server's identity, preventing man-in-the-middle attacks.

Ruby's standard library, particularly Net::HTTP, transparently handles much of this complexity. By default, when you connect to an HTTPS URI, Net::HTTP activates SSL/TLS and attempts to verify the server's certificate against a system-wide or bundled set of trusted Certificate Authorities (CAs). This default behavior is a critical security leverage point, ensuring that most secure connections are established without explicit configuration. However, understanding this underlying mechanism empowers us to customize and fortify our connections when specific security requirements arise.

A server certificate is essentially a digital identity card, issued by a trusted CA, containing the server's public key and domain information. The chain of trust extends from the server's certificate back to a root CA certificate, which is implicitly trusted by your system. We engineer our scripts to respect this chain, ensuring that every byte exchanged is protected by robust encryption and authenticated by a verifiable identity. The provided code snippet illustrates a basic secure GET request using Net::HTTP, leveraging Ruby's default secure connection handling.

# frozen_string_literal: true

require 'net/http'
require 'uri'
require 'json'

# Forge a URI object for the target HTTPS endpoint
uri = URI.parse('https://api.github.com/')

# Establish a Net::HTTP connection
Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == 'https') do |http|
  # Configure HTTP request for a GET operation
  request = Net::HTTP::Get.new(uri)

  # Send the request and capture the response
  response = http.request(request)

  # Analyze the response status and body
  case response
  when Net::HTTPSuccess
    puts 'Successfully connected to GitHub API.'
    puts "Response Code: #{response.code}"
    # Optionally, parse and display a portion of the JSON body
    # puts JSON.pretty_generate(JSON.parse(response.body))
  else
    puts "Failed to connect: #{response.code} #{response.message}"
    puts "Response Body: #{response.body}"
  end
end

puts "\nDemonstrating basic secure connection with Net::HTTP."
puts "Ruby's Net::HTTP automatically attempts SSL/TLS verification by default."

Engineer Robust Server Certificate Verification

We move to engineer robust server certificate verification, a critical layer in securing communications. While Ruby's Net::HTTP provides default verification, advanced scenarios demand explicit control. The OpenSSL::SSL::SSLContext class and its configurations empower us to dictate how certificate verification proceeds. The cornerstone of this control is http.verify_mode = OpenSSL::SSL::VERIFY_PEER. This directive mandates that your script rigorously checks the server's certificate and its entire chain of trust up to a trusted root CA.

A common leverage point involves specifying a custom Certificate Authority file or directory using http.ca_file or http.ca_path. This is indispensable when communicating with internal services that use certificates issued by your organization's private CA, or when you need to explicitly trust a specific CA bundle different from the system defaults. By providing a ca_file (a PEM-formatted file containing one or more CA certificates), you instruct Ruby's OpenSSL to use only these specified CAs for verifying the server's certificate.

Conversely, neglecting proper verification, often by setting verify_mode = OpenSSL::SSL::VERIFY_NONE (which we strongly advise against in production), exposes your scripts to severe security risks, including impersonation and data interception. We activate precise verification to mitigate these threats, fostering a secure operational environment. The included code demonstrates configuring Net::HTTP for explicit peer verification and highlights how to specify a custom CA file. We include a setup to create a dummy CA file for local testing, emphasizing that in production, you would point to a legitimate, established CA bundle.

# frozen_string_literal: true

require 'net/http'
require 'uri'
require 'openssl'

# --- Setup: Create a dummy CA cert file for demonstration ---
# In a real-world scenario, you would point to a legitimate CA bundle
# like '/etc/ssl/certs/ca-certificates.crt' or a specific PEM file.
# For this example, we'll create a simple self-signed CA cert if it doesn't exist
# and then simulate using it for verification.

# NOTE: This is for demonstration ONLY. DO NOT use self-signed certs
# for public-facing production systems without careful consideration.

CA_CERT_FILE = 'my_custom_ca.pem'

unless File.exist?(CA_CERT_FILE)
  puts "Creating a dummy CA certificate for demonstration: #{CA_CERT_FILE}"
  # Generate a private key for the CA
  ca_key = OpenSSL::PKey::RSA.new(2048)

  # Create a self-signed CA certificate
  ca_cert = OpenSSL::X509::Certificate.new
  ca_cert.subject = ca_cert.issuer = OpenSSL::X509::Name.parse('/C=US/O=MyOrg/CN=MyCustomCA')
  ca_cert.serial = 1
  ca_cert.not_before = Time.now
  ca_cert.not_after = Time.now + 60 * 60 * 24 * 365 * 5 # 5 years
  ca_cert.public_key = ca_key.public_key
  ca_cert.sign(ca_key, OpenSSL::Digest::SHA256.new)

  # Save the CA certificate to a file
  File.write(CA_CERT_FILE, ca_cert.to_pem)
  puts "Dummy CA certificate created. In a real scenario, this would be your trusted CA bundle."
end
# --- End Setup ---


# Forge a URI object for the target HTTPS endpoint (replace with an actual URL if not testing against self-signed)
# For testing against a server whose certificate is signed by 'my_custom_ca.pem'
# You would typically target a server that presents a cert signed by a CA in your specified CA_CERT_FILE.
# Example: If you have a test server whose cert is signed by 'my_custom_ca.pem', use its URL here.
# For general demonstration, we can use a public API and expect a failure if the CA isn't global.

# For live testing, point to a real URL that is *not* signed by your dummy CA to see verification failure.
# Or, for success, point to a local test server configured to use a cert signed by your dummy CA.
uri = URI.parse('https://badssl.com/expired/') # An expired cert, expected to fail verification
# Or, for a standard success case (using system CAs, not custom CA for this public site)
# uri = URI.parse('https://api.github.com/')

Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == 'https') do |http|
  # Instantiate SSLContext to customize verification parameters
  http.verify_mode = OpenSSL::SSL::VERIFY_PEER

  # Specify a custom CA certificate file or directory
  # This instructs Ruby to use 'my_custom_ca.pem' instead of system defaults to verify server certs.
  # For a public site like github, this custom CA might not contain the necessary root for github.com's cert.
  # http.ca_file = CA_CERT_FILE # Uncomment to use the custom CA file for verification

  # For public sites, we often rely on system CAs. If 'ca_file' is not set,
  # Ruby defaults to system CAs or the bundled certificates.
  # To explicitly trust only a specific CA, you *would* set ca_file.

  # Example for explicit CA file verification (use if you're targeting a server with a cert signed by your CA_CERT_FILE)
  # For badssl.com/expired, we expect failure regardless of CA_CERT_FILE if the system CA bundle is used, or if
  # a custom CA bundle that *doesn't* include the badssl.com root is used.
  # Let's explicitly set ca_file to see how it affects public sites. For a valid public site, this might cause errors
  # if 'my_custom_ca.pem' doesn't contain the necessary root CAs.
  begin
    # For this example, let's try a public site and see how `ca_file` impacts it.
    # Using a *known good* public site with a custom CA that likely doesn't include its root CA
    # will demonstrate how strict `ca_file` makes verification.
    # To actually *succeed* with a custom CA_CERT_FILE, the target server's certificate MUST be signed by a CA
    # present in that custom file.

    # Let's remove the ca_file for general public site testing, or provide a legitimate one.
    # For robust verification of a public site, let system CAs do their job unless a specific CA is required.

    # Revert to system default for this public example to ensure it can actually connect (and still fail on expired if applicable)
    # Or, if you want to force custom CA for a specific server (e.g., internal network),
    # ensure that server's cert is signed by the CA in CA_CERT_FILE.

    # For the badssl.com/expired example, it should fail verification due to expiry, irrespective of CA file.
    # Let's demonstrate verification control for a *valid* public site first.

    # If we target 'https://api.github.com/' and provide a custom CA_CERT_FILE that doesn't include the necessary GitHub CAs,
    # it *should* fail verification, demonstrating strictness.
    puts "\nAttempting connection to #{uri}..."
    http.verify_mode = OpenSSL::SSL::VERIFY_PEER # Ensure peer verification is active
    # http.ca_file = CA_CERT_FILE # UNCOMMENT TO FORCE CUSTOM CA TRUST FOR VERIFICATION

    request = Net::HTTP::Get.new(uri)
    response = http.request(request)

    when Net::HTTPSuccess
      puts "Successfully connected to #{uri.host}."
      puts "Response Code: #{response.code}"
    else
      puts "Connection to #{uri.host} failed: #{response.code} #{response.message}"
      puts "Response Body: #{response.body}"
    end
  rescue OpenSSL::SSL::SSLError => e
    puts "SSL/TLS Verification Error: #{e.message}"
    puts "This typically indicates an issue with the server's certificate or your trust store."
    puts "Common causes: expired certificate, untrusted CA, hostname mismatch."
  rescue StandardError => e
    puts "An unexpected error occurred: #{e.class} - #{e.message}"
  end
end

puts "\nDemonstrating explicit server certificate verification using OpenSSL::SSL::VERIFY_PEER and potentially custom CA_CERT_FILE."

Decipher Client Certificates and Mutual TLS (mTLS)

We decode the intricacies of client certificates and Mutual TLS (mTLS), elevating our security posture beyond mere server verification. While standard SSL/TLS validates the server to the client, mTLS extends this trust by also requiring the client to present its own certificate to the server. This dual authentication mechanism creates a highly fortified channel, ensuring both parties are authenticated and authorized before data exchange commences. It's an indispensable strategy for API security, microservices communication, and highly sensitive internal systems.

Implementing mTLS in Ruby involves supplying your script with a client certificate and its corresponding private key. The Net::HTTP object provides dedicated attributes for this purpose: http.cert = client_cert and http.key = client_key. The client_cert must be an OpenSSL::X509::Certificate object, and the client_key an OpenSSL::PKey::RSA (or similar) object, loaded from their respective PEM files. We forge these objects from file contents, then attach them to our HTTP connection.

When your Ruby script initiates an mTLS connection, the server, having been configured to request a client certificate, will demand this credential during the SSL/TLS handshake. If your client certificate is valid and issued by a CA that the server trusts, the connection proceeds. If not, the handshake fails, preventing unauthorized access. This layered authentication transforms access control into an algorithmic gatekeeper. The included code demonstrates how to load and assign client certificates and keys, preparing your script for mTLS interactions. We include setup to generate dummy client credentials for local experimentation, emphasizing the need for legitimate credentials in production.

# frozen_string_literal: true

require 'net/http'
require 'uri'
require 'openssl'

# --- Setup: Create dummy client cert and key for demonstration ---
# In a real-world scenario, these would be legitimate client credentials.
CLIENT_CERT_FILE = 'client_cert.pem'
CLIENT_KEY_FILE = 'client_key.pem'
CA_CERT_FILE = 'my_custom_ca.pem' # Re-use the dummy CA from previous step if available

unless File.exist?(CLIENT_CERT_FILE) && File.exist?(CLIENT_KEY_FILE)
  puts "Creating a dummy client certificate and key for demonstration..."
  # Generate a private key for the client
  client_key = OpenSSL::PKey::RSA.new(2048)
  File.write(CLIENT_KEY_FILE, client_key.to_pem)

  # Create a client certificate request (CSR)
  client_csr = OpenSSL::X509::Request.new
  client_csr.subject = OpenSSL::X509::Name.parse('/C=US/O=MyOrg/CN=MyClient')
  client_csr.public_key = client_key.public_key
  client_csr.sign(client_key, OpenSSL::Digest::SHA256.new)

  # Self-sign the client certificate for simplicity in this demo
  # In a real scenario, you'd have a CA sign this CSR.
  # For a demo, let's use our dummy CA to sign it.

  # Load dummy CA key and cert to sign client cert
  if File.exist?(CA_CERT_FILE)
    ca_cert = OpenSSL::X509::Certificate.new(File.read(CA_CERT_FILE))
    ca_key = OpenSSL::PKey::RSA.new(File.read('my_custom_ca_key.pem')) rescue OpenSSL::PKey::RSA.new(2048) # Assuming CA key was also saved or created previously.
                                                                                        # NOTE: For this specific dummy CA_CERT_FILE, we only saved the cert.
                                                                                        # If you want to actually sign, you'd need the CA's private key too.
                                                                                        # For simple demo, let's self-sign the client cert for now.

    client_cert = OpenSSL::X509::Certificate.new
    client_cert.subject = client_csr.subject
    client_cert.issuer = ca_cert.subject # Issued by our dummy CA
    client_cert.public_key = client_csr.public_key
    client_cert.serial = 2
    client_cert.not_before = Time.now
    client_cert.not_after = Time.now + 60 * 60 * 24 * 365 # 1 year
    client_cert.sign(ca_key, OpenSSL::Digest::SHA256.new) # Sign with CA's private key
  else
    # Fallback to self-signing if CA key not available (less realistic for mTLS, but simple for demo)
    client_cert = OpenSSL::X509::Certificate.new
    client_cert.subject = client_cert.issuer = client_csr.subject
    client_cert.public_key = client_csr.public_key
    client_cert.serial = 2
    client_cert.not_before = Time.now
    client_cert.not_after = Time.now + 60 * 60 * 24 * 365 # 1 year
    client_cert.sign(client_key, OpenSSL::Digest::SHA256.new) # Self-sign
  end

  File.write(CLIENT_CERT_FILE, client_cert.to_pem)
  puts "Dummy client certificate and key created."
end
# --- End Setup ---


# Forge a URI object for a target that expects mTLS
# This URL should point to a server configured to request client certificates.
# For a true mTLS test, you'd need a server (e.g., Nginx, Apache, or a Ruby server)
# configured to demand client certificates issued by a CA you trust.
# Example: If you have a local server at 'https://localhost:8443/' requiring mTLS.
# For this demonstration, we'll connect to a public HTTPS site which *won't* request mTLS
# but will show how to provide the cert/key. The mTLS aspect won't be fully tested without a server.
uri = URI.parse('https://api.github.com/') # A public API, doesn't require mTLS, but demonstrates options.

Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.verify_mode = OpenSSL::SSL::VERIFY_PEER # Always verify server cert
  # http.ca_file = CA_CERT_FILE # Use custom CA if server cert is signed by it

  # Load client certificate and private key
  client_cert = OpenSSL::X509::Certificate.new(File.read(CLIENT_CERT_FILE))
  client_key = OpenSSL::PKey::RSA.new(File.read(CLIENT_KEY_FILE))

  # Assign client certificate and key to the HTTP object
  http.cert = client_cert
  http.key = client_key
  puts "\nConfigured client certificate and key for outgoing request."

  begin
    request = Net::HTTP::Get.new(uri)
    response = http.request(request)

    case response
    when Net::HTTPSuccess
      puts "Successfully connected to #{uri.host} with client certificate (if requested by server)."
      puts "Response Code: #{response.code}"
    else
      puts "Connection to #{uri.host} failed: #{response.code} #{response.message}"
      puts "Response Body: #{response.body}"
    end
  rescue OpenSSL::SSL::SSLError => e
    puts "SSL/TLS Error during connection with client cert: #{e.message}"
    puts "Possible causes: Server rejected client certificate, incorrect client cert/key, or CA mismatch."
  rescue StandardError => e
    puts "An unexpected error occurred: #{e.class} - #{e.message}"
  end
end

puts "\nDemonstrating how to configure client certificates for Mutual TLS (mTLS) or client authentication."

Optimize Troubleshooting and Fortify Practices for Certificate Management

We conclude by optimizing troubleshooting methodologies and fortifying best practices for certificate management in Ruby. Even with meticulous configuration, SSL/TLS errors surface, demanding surgical analysis. Common pitfalls include expired certificates, untrusted Certificate Authorities (CAs), hostname mismatches, and incorrect client certificate provisioning. Each error message from OpenSSL::SSL::SSLError provides a crucial diagnostic clue, requiring precise interpretation.

When encountering `certificate verify failed`, investigate the server's certificate chain. Has it expired? Is it self-signed? Does your system or explicit ca_file trust the issuing CA? The `openssl s_client -connect hostname:port -showcerts` command is an indispensable external tool, revealing the server's certificate chain and allowing us to inspect its validity and issuer. Activating http.set_debug_output($stderr) within Net::HTTP elevates debugging visibility, streaming verbose SSL handshake details directly to your console, a potent leverage point for pinpointing issues.

To fortify our practices, we always activate OpenSSL::SSL::VERIFY_PEER in production environments. Never disable verification for convenience. Regularly update your system's CA trust store to incorporate new root CAs and revoke compromised ones. For performance, consider pooling HTTP connections, reducing the overhead of repeated SSL handshakes. We engineer our scripts not only to connect securely but also to robustly anticipate and diagnose failure, transforming potential outages into actionable intelligence. The provided code dissects common SSL error messages, guiding you through a systematic troubleshooting process for prevalent certificate issues.

# frozen_string_literal: true

require 'net/http'
require 'uri'
require 'openssl'

# Forge a URI object for a known problematic HTTPS endpoint
# Example: an expired certificate, a self-signed cert not in trust store
uri_expired = URI.parse('https://badssl.com/expired/')
uri_self_signed = URI.parse('https://self-signed.badssl.com/')

def test_connection(uri_target, description)
  puts "\n--- Testing connection to: #{description} (#{uri_target}) ---"
  Net::HTTP.start(uri_target.host, uri_target.port, use_ssl: uri_target.scheme == 'https') do |http|
    # Always activate VERIFY_PEER in production
    http.verify_mode = OpenSSL::SSL::VERIFY_PEER

    # Optionally, increase debug level for Net::HTTP to see more detail
    # http.set_debug_output($stderr) # Uncomment to stream verbose debug info to console

    request = Net::HTTP::Get.new(uri_target)
    begin
      response = http.request(request)

      if response.is_a?(Net::HTTPSuccess)
        puts "Connection successful! Response Code: #{response.code}"
      else
        puts "Connection failed HTTP-wise: #{response.code} #{response.message}"
      end
    rescue OpenSSL::SSL::SSLError => e
      # Decode common SSL errors
      puts "SSL/TLS Error detected: #{e.message}"
      if e.message.include?('certificate verify failed')
        puts "  - This often means the server's certificate is not trusted (e.g., self-signed, untrusted CA, expired).
             Check system CA bundle or configure http.ca_file correctly."
      elsif e.message.include?('certificate has expired')
        puts "  - The server's certificate has expired. Contact the server administrator."
      elsif e.message.include?('hostname does not match')
        puts "  - The certificate's common name (CN) or Subject Alternative Name (SAN) does not match the hostname you're connecting to.
             Verify the URL and the certificate details."
      elsif e.message.include?('self signed certificate')
        puts "  - The server presented a self-signed certificate, which is not trusted by default. Consider adding its CA to your trust store if appropriate (e.g., for internal services)."
      else
        puts "  - Review server certificate status and your Ruby OpenSSL configuration."
      end
    rescue Net::ReadTimeout, Net::OpenTimeout => e
      puts "Network Timeout Error: #{e.message}. The server might be unreachable or slow."
    rescue StandardError => e
      puts "An unexpected error occurred: #{e.class} - #{e.message}"
    end
  end
end

# Execute tests against problematic endpoints
test_connection(uri_expired, 'Server with an expired certificate')
test_connection(uri_self_signed, 'Server with a self-signed certificate')

Key Takeaways

Core SSL/TLS Principles in Ruby

Ruby's Net::HTTP automatically manages SSL/TLS for HTTPS connections, performing server certificate verification against system trust stores by default. This foundational behavior ensures basic secure communication without explicit configuration, relying on a chain of trust from the server's certificate to a trusted Certificate Authority (CA).

Customizing Server Certificate Validation

To exert fine-grained control over server certificate validation, activate http.verify_mode = OpenSSL::SSL::VERIFY_PEER. For internal services or specific trust requirements, explicitly set http.ca_file to point to a custom PEM-formatted CA certificate bundle. This enforces trust in specific CAs, overriding or supplementing system defaults and crucial for enterprise-specific security policies.

Implementing Mutual TLS (mTLS) for Dual Authentication

Mutual TLS (mTLS) fortifies security by requiring both the client (your Ruby script) and the server to authenticate each other using digital certificates. Implement this by loading your client's OpenSSL::X509::Certificate and its corresponding private OpenSSL::PKey::RSA key, then assigning them to http.cert and http.key respectively. mTLS is indispensable for securing highly sensitive API interactions and microservices.

Essential Troubleshooting and Security Hardening

Systematically troubleshoot SSL/TLS errors by decoding OpenSSL::SSL::SSLError messages, which often indicate expired certificates, untrusted CAs, or hostname mismatches. Utilize external tools like openssl s_client and enable http.set_debug_output for verbose diagnostics. Always maintain VERIFY_PEER in production and keep CA trust stores updated. Never disable verification for production connections.

Editorial Team
← Engineer Production-Ready Ruby Dockerfiles Engineer Resilient Ruby API Clients with Faraday & Error Handling →

FAQ

  • Why is 'certificate verify failed' a common error in Ruby SSL/TLS scripts?

    'Certificate verify failed' is prevalent because it encompasses several underlying issues. Primarily, it means Ruby's OpenSSL library could not establish a chain of trust from the server's presented certificate back to a trusted Root CA in its trust store. This can be due to an expired server certificate, a self-signed certificate (not trusted by default), a missing intermediate CA certificate in the server's chain, or an outdated local CA bundle on your system. It also occurs if the hostname in the URL does not match the certificate's Common Name (CN) or Subject Alternative Name (SAN).

  • How can I programmatically specify a custom CA certificate file in Ruby?

    To programmatically specify a custom CA certificate file, you configure the Net::HTTP object's ca_file attribute. First, ensure http.verify_mode is set to OpenSSL::SSL::VERIFY_PEER. Then, assign the path to your PEM-formatted CA bundle:

    http.ca_file = '/path/to/your/custom_ca_bundle.pem'

    This directs OpenSSL to use your specified CA file, instead of or in addition to system-wide defaults, for validating the server's certificate.

  • What is Mutual TLS (mTLS) and when should I use it in Ruby applications?

    Mutual TLS (mTLS) is an extension of standard TLS where both the client and the server authenticate each other using digital certificates. It creates a highly secure, dual-authenticated communication channel. You should deploy mTLS in Ruby applications when:

    • High Security is Paramount: For sensitive APIs, microservices communication, or internal services requiring stringent access control.
    • Client Authentication is Critical: To verify the identity of the client application itself, not just the user, before granting access.
    • Preventing Unauthorized Access: Ensures only clients possessing valid, trusted certificates can establish a connection, significantly reducing attack surface.

    It adds a layer of trust that goes beyond simple username/password or API key authentication.

  • Is it ever safe to disable SSL/TLS certificate verification using `OpenSSL::SSL::VERIFY_NONE`?

    We strongly advise against disabling SSL/TLS certificate verification by setting http.verify_mode = OpenSSL::SSL::VERIFY_NONE in any production environment or for connections handling sensitive data. While it might resolve immediate connection issues, it completely nullifies the security benefits of SSL/TLS. Your script would then accept any server certificate, regardless of its validity, expiration, or issuer, making it vulnerable to man-in-the-middle attacks, data interception, and server impersonation. Reserve this setting strictly for controlled, local development or debugging environments where security risks are fully understood and mitigated by other means, and never deploy it to production.