mongo 2.4.1 → 2.14.0

data/spec/mongo/socket/ssl_spec.rb

@@ -1,34 +1,37 @@
 require 'spec_helper'
 
-describe Mongo::Socket::SSL, if: running_ssl? do
+# this test performs direct network connections without retries.
+# In case of intermittent network issues, retry the entire failing test.
+describe Mongo::Socket::SSL, retry: 3 do
+  clean_slate_for_all
+  require_tls
+
+  let(:host_name) { 'localhost' }
 
   let(:socket) do
-    described_class.new(*default_address.to_s.split(":"), default_address.host, 5, Socket::PF_INET, options)
+    described_class.new('127.0.0.1', default_address.port,
+      host_name, 1, :INET, ssl_options.merge(
+        connect_timeout: 2.4))
   end
 
-  let(:options) do
-    {
-      :ssl => true,
-      :ssl_cert => CLIENT_CERT_PEM,
-      :ssl_key => CLIENT_KEY_PEM,
-      :ssl_verify => false
-    }
+  let(:ssl_options) do
+    SpecConfig.instance.ssl_options
   end
 
   let (:key_string) do
-    File.read(CLIENT_KEY_PEM)
+    File.read(SpecConfig.instance.local_client_key_path)
   end
 
   let (:cert_string) do
-    File.read(CLIENT_CERT_PEM)
+    File.read(SpecConfig.instance.local_client_cert_path)
   end
 
   let (:ca_cert_string) do
-    File.read(CA_PEM)
+    File.read(SpecConfig.instance.local_ca_cert_path)
   end
 
   let(:key_encrypted_string) do
-    File.read(CLIENT_KEY_ENCRYPTED_PEM)
+    File.read(SpecConfig.instance.client_encrypted_key_path)
   end
 
   let(:cert_object) do
@@ -39,16 +42,19 @@ describe Mongo::Socket::SSL, if: running_ssl? do
     OpenSSL::PKey.read(key_string)
   end
 
+  describe '#human_address' do
+    it 'returns the address and tls indicator' do
+      addr = socket.instance_variable_get(:@tcp_socket).remote_address
+      expect(socket.send(:human_address)).to eq("#{addr.ip_address}:#{addr.ip_port} (#{default_address}, TLS)")
+    end
+  end
+
   describe '#connect!' do
 
     context 'when a certificate is provided' do
 
       context 'when connecting the tcp socket is successful' do
 
-        before do
-          socket.connect!
-        end
-
         it 'connects to the server' do
           expect(socket).to be_alive
         end
@@ -56,28 +62,18 @@ describe Mongo::Socket::SSL, if: running_ssl? do
 
       context 'when connecting the tcp socket raises an exception' do
 
-        before do
-          tcp_socket = socket.instance_variable_get(:@tcp_socket)
-          allow(tcp_socket).to receive(:connect).and_raise(Mongo::Error::SocketTimeoutError)
-        end
-
-        let!(:result) do
-          begin
-            socket.connect!
-          rescue => e
-            e
-          end
-        end
-
         it 'raises an exception' do
-          expect(result).to be_a(Mongo::Error::SocketTimeoutError)
+          expect_any_instance_of(::Socket).to receive(:connect).and_raise(Mongo::Error::SocketTimeoutError)
+          expect do
+            socket
+          end.to raise_error(Mongo::Error::SocketTimeoutError)
         end
       end
     end
 
     context 'when a certificate and key are provided as strings' do
 
-      let(:options) do
+      let(:ssl_options) do
         {
           :ssl => true,
           :ssl_cert_string => cert_string,
@@ -86,31 +82,24 @@ describe Mongo::Socket::SSL, if: running_ssl? do
         }
       end
 
-      before do
-        socket.connect!
-      end
-
       it 'connects to the server' do
         expect(socket).to be_alive
       end
     end
 
     context 'when certificate and an encrypted key are provided as strings' do
+      require_local_tls
 
-      let(:options) do
+      let(:ssl_options) do
         {
           :ssl => true,
           :ssl_cert_string => cert_string,
           :ssl_key_string => key_encrypted_string,
-          :ssl_key_pass_phrase => CLIENT_KEY_PASSPHRASE,
+          :ssl_key_pass_phrase => SpecConfig.instance.client_encrypted_key_passphrase,
           :ssl_verify => false
         }
       end
 
-      before do
-        socket.connect!
-      end
-
       it 'connects to the server' do
         expect(socket).to be_alive
       end
@@ -118,7 +107,7 @@ describe Mongo::Socket::SSL, if: running_ssl? do
 
     context 'when a certificate and key are provided as objects' do
 
-      let(:options) do
+      let(:ssl_options) do
         {
           :ssl => true,
           :ssl_cert_object => cert_object,
@@ -127,10 +116,6 @@ describe Mongo::Socket::SSL, if: running_ssl? do
         }
       end
 
-      before do
-        socket.connect!
-      end
-
       it 'connects to the server' do
         expect(socket).to be_alive
       end
@@ -138,16 +123,12 @@ describe Mongo::Socket::SSL, if: running_ssl? do
 
     context 'when the certificate is specified using both a file and a PEM-encoded string' do
 
-      let(:options) do
+      let(:ssl_options) do
         super().merge(
           :ssl_cert_string => 'This is a random string, not a PEM-encoded certificate'
         )
       end
 
-      before do
-        socket.connect!
-      end
-
       # since the lower priority option is clearly invalid we verify priority by checking that it connects
       it 'discards the value of :ssl_cert_string' do
         expect(socket).to be_alive
@@ -156,16 +137,12 @@ describe Mongo::Socket::SSL, if: running_ssl? do
 
     context 'when the certificate is specified using both a file and an object' do
 
-      let(:options) do
+      let(:ssl_options) do
         super().merge(
           :ssl_cert_object => 'This is a string, not a certificate'
         )
       end
 
-      before do
-        socket.connect!
-      end
-
       # since the lower priority option is clearly invalid we verify priority by checking that it connects
       it 'discards the value of :ssl_cert_object' do
         expect(socket).to be_alive
@@ -174,20 +151,16 @@ describe Mongo::Socket::SSL, if: running_ssl? do
 
     context 'when the certificate is specified using both a PEM-encoded string and an object' do
 
-      let(:options) do
+      let(:ssl_options) do
         {
           :ssl => true,
           :ssl_cert_string => cert_string,
           :ssl_cert_object => 'This is a string, not a Certificate',
-          :ssl_key => CLIENT_KEY_PEM,
+          :ssl_key => SpecConfig.instance.client_key_path,
           :ssl_verify => false
         }
       end
 
-      before do
-        socket.connect!
-      end
-
       # since the lower priority option is clearly invalid we verify priority by checking that it connects
       it 'discards the value of :ssl_cert_object' do
         expect(socket).to be_alive
@@ -196,16 +169,12 @@ describe Mongo::Socket::SSL, if: running_ssl? do
 
     context 'when the key is specified using both a file and a PEM-encoded string' do
 
-      let(:options) do
+      let(:ssl_options) do
         super().merge(
           :ssl_key_string => 'This is a normal string, not a PEM-encoded key'
         )
       end
 
-      before do
-        socket.connect!
-      end
-
       # since the lower priority option is clearly invalid we verify priority by checking that it connects
       it 'discards the value of :ssl_key_string' do
         expect(socket).to be_alive
@@ -214,16 +183,12 @@ describe Mongo::Socket::SSL, if: running_ssl? do
 
     context 'when the key is specified using both a file and an object' do
 
-      let(:options) do
+      let(:ssl_options) do
         super().merge(
           :ssl_cert_object => 'This is a string, not a key'
         )
       end
 
-      before do
-        socket.connect!
-      end
-
       # since the lower priority option is clearly invalid we verify priority by checking that it connects
       it 'discards the value of :ssl_key_object' do
         expect(socket).to be_alive
@@ -232,20 +197,16 @@ describe Mongo::Socket::SSL, if: running_ssl? do
 
     context 'when the key is specified using both a PEM-encoded string and an object' do
 
-      let(:options) do
+      let(:ssl_options) do
         {
           :ssl => true,
-          :ssl_cert => CLIENT_CERT_PEM,
+          :ssl_cert => SpecConfig.instance.client_cert_path,
           :ssl_key_string => key_string,
           :ssl_key_object => 'This is a string, not a PKey',
           :ssl_verify => false
         }
       end
 
-      before do
-        socket.connect!
-      end
-
       # since the lower priority option is clearly invalid we verify priority by checking that it connects
       it 'discards the value of :ssl_key_object' do
         expect(socket).to be_alive
@@ -254,96 +215,230 @@ describe Mongo::Socket::SSL, if: running_ssl? do
 
     context 'when a certificate is passed, but it is not of the right type' do
 
-      let(:options) do
-        cert = "This is a string, not a X509 Certificate"
+      let(:ssl_options) do
+        cert = "This is a string, not an X.509 Certificate"
         {
           :ssl => true,
           :ssl_cert_object => cert,
-          :ssl_key => CLIENT_KEY_PEM,
+          :ssl_key => SpecConfig.instance.local_client_key_path,
           :ssl_verify => false
         }
       end
 
       it 'raises a TypeError' do
-        expect{
-          socket.connect!
-        }.to raise_exception(TypeError)
+        expect do
+          socket
+        end.to raise_exception(TypeError)
       end
     end
 
-    context 'when a key is passed, but it is not of the right type' do
-      let(:options) do
-        key = "This is a string not a key"
-        {
-          :ssl => true,
-          :ssl_key_object => key,
-          :ssl_cert => CLIENT_CERT_PEM,
-          :ssl_verify => false
-        }
+    context 'when the hostname is incorrect' do
+      let(:host_name) do
+        'incorrect_hostname'
       end
 
-      it 'raises a TypeError' do
-        expect{
-          socket.connect!
-        }.to raise_exception(TypeError)
+      context 'when the hostname is verified' do
+
+        let(:ssl_options) do
+          SpecConfig.instance.ssl_options.merge(ssl_verify: false, ssl_verify_hostname: true)
+        end
+
+        it 'raises an error' do
+          lambda do
+            socket
+          end.should raise_error(Mongo::Error::SocketError, /TLS handshake failed due to a hostname mismatch/)
+        end
+      end
+
+      context 'when the hostname is not verified' do
+        let(:ssl_options) do
+          SpecConfig.instance.ssl_options.merge(ssl_verify: false, ssl_verify_hostname: false)
+        end
+
+        it 'does not raise an error' do
+          lambda do
+            socket
+          end.should_not raise_error
+        end
       end
     end
 
-    context 'when a bad certificate is provided' do
+    context 'when ruby version is < 2.4.1' do
+      ruby_version_lt '2.4.1'
 
-      let(:options) do
-        super().merge(
-          :ssl_key => CRL_PEM
-        )
+      context 'when a key is passed, but it is not of the right type' do
+
+        let(:ssl_options) do
+          key = "This is a string not a key"
+          {
+              :ssl => true,
+              :ssl_key_object => key,
+              :ssl_cert => SpecConfig.instance.client_cert_path,
+              :ssl_verify => false
+          }
+        end
+
+        it 'raises a TypeError' do
+          expect do
+            socket
+          end.to raise_exception(TypeError)
+        end
+      end
+    end
+
+    # Note that as of MRI 2.4, Creating a socket with the wrong key type raises
+    # a NoMethodError because #private? is attempted to be called on the key.
+    # In jruby 9.2 a TypeError is raised.
+    # In jruby 9.1 a OpenSSL::PKey::PKeyError is raised.
+    context 'when ruby version is >= 2.4.1' do
+      ruby_version_gte '2.4.1'
+
+      context 'when a key is passed, but it is not of the right type' do
+
+        let(:ssl_options) do
+          key = "This is a string not a key"
+          {
+              :ssl => true,
+              :ssl_key_object => key,
+              :ssl_cert => SpecConfig.instance.client_cert_path,
+              :ssl_verify => false
+          }
+        end
+
+        let(:expected_exception) do
+          if SpecConfig.instance.jruby?
+            if RUBY_VERSION >= '2.5.0'
+              # jruby 9.2
+              TypeError
+            else
+              # jruby 9.1
+              OpenSSL::OpenSSLError
+            end
+          else
+            NoMethodError
+          end
+        end
+
+        it 'raises a NoMethodError' do
+          expect do
+            socket
+          end.to raise_exception(expected_exception)
+        end
+      end
+    end
+
+    context 'when a bad certificate/key is provided' do
+
+      shared_examples_for 'raises an exception' do
+        it 'raises an exception' do
+          expect do
+            socket
+          end.to raise_exception(*expected_exception)
+        end
+      end
+
+      context 'mri' do
+        require_mri
+
+        context 'when a bad certificate is provided' do
+
+          let(:expected_exception) do
+            # OpenSSL::X509::CertificateError: nested asn1 error
+            [OpenSSL::OpenSSLError, /asn1 error/i]
+          end
+
+          let(:ssl_options) do
+            super().merge(
+              :ssl_cert => COMMAND_MONITORING_TESTS.first,
+              :ssl_key => nil,
+            )
+          end
+
+          it_behaves_like 'raises an exception'
+        end
+
+        context 'when a bad key is provided' do
+
+          let(:expected_exception) do
+            if RUBY_VERSION >= '2.4.0'
+              # OpenSSL::PKey::PKeyError: Could not parse PKey: no start line
+              [OpenSSL::OpenSSLError, /Could not parse PKey/]
+            else
+              # ArgumentError: Could not parse PKey: no start line
+              [ArgumentError, /Could not parse PKey/]
+            end
+          end
+
+          let(:ssl_options) do
+            super().merge(
+              :ssl_cert => nil,
+              :ssl_key => COMMAND_MONITORING_TESTS.first,
+            )
+          end
+
+          it_behaves_like 'raises an exception'
+        end
       end
 
-      it 'raises an exception' do
-        expect {
-          socket.connect!
-        }.to raise_exception(ArgumentError)
+      context 'jruby' do
+        require_jruby
+
+        # On JRuby the key does not appear to be parsed, therefore only
+        # specifying the bad certificate produces an error.
+
+        context 'when a bad certificate is provided' do
+
+          let(:ssl_options) do
+            super().merge(
+              :ssl_cert => COMMAND_MONITORING_TESTS.first,
+              :ssl_key => nil,
+            )
+          end
+
+          let(:expected_exception) do
+            # java.lang.ClassCastException: org.bouncycastle.asn1.DERApplicationSpecific cannot be cast to org.bouncycastle.asn1.ASN1Sequence
+            # OpenSSL::X509::CertificateError: parsing issue: malformed PEM data: no header found
+            [OpenSSL::OpenSSLError, /malformed pem data/i]
+          end
+
+          it_behaves_like 'raises an exception'
+        end
       end
     end
 
-    context 'when a CA certificate is provided', if: testing_ssl_locally? do
+    context 'when a CA certificate is provided' do
+      require_local_tls
 
       context 'as a path to a file' do
 
-        let(:options) do
+        let(:ssl_options) do
           super().merge(
-            :ssl_ca_cert => CA_PEM,
+            :ssl_ca_cert => SpecConfig.instance.local_ca_cert_path,
             :ssl_verify => true
           )
         end
 
-        before do
-          socket.connect!
-        end
-
         it 'connects to the server' do
           expect(socket).to be_alive
         end
       end
 
-      context 'as a string containg the PEM-encoded certificate' do
+      context 'as a string containing the PEM-encoded certificate' do
 
-        let (:options) do
+        let(:ssl_options) do
           super().merge(
             :ssl_ca_cert_string => ca_cert_string,
             :ssl_verify => true
           )
         end
 
-        before do
-          socket.connect!
-        end
-
         it 'connects to the server' do
           expect(socket).to be_alive
         end
       end
 
       context 'as an array of Certificate objects' do
-        let (:options) do
+        let(:ssl_options) do
           cert = [OpenSSL::X509::Certificate.new(ca_cert_string)]
           super().merge(
             :ssl_ca_cert_object => cert,
@@ -351,10 +446,6 @@ describe Mongo::Socket::SSL, if: running_ssl? do
           )
         end
 
-        before do
-          socket.connect!
-        end
-
         it 'connects to the server' do
           expect(socket).to be_alive
         end
@@ -362,18 +453,14 @@ describe Mongo::Socket::SSL, if: running_ssl? do
 
       context 'both as a file and a PEM-encoded parameter' do
 
-        let(:options) do
+        let(:ssl_options) do
           super().merge(
-            :ssl_ca_cert => CA_PEM,
+            :ssl_ca_cert => SpecConfig.instance.local_ca_cert_path,
             :ssl_ca_cert_string => 'This is a string, not a certificate',
             :ssl_verify => true
           )
         end
 
-        before do
-          socket.connect!
-        end
-
         # since the lower priority option is clearly invalid we verify priority by checking that it connects
         it 'discards the value of :ssl_ca_cert_string' do
           expect(socket).to be_alive
@@ -382,18 +469,14 @@ describe Mongo::Socket::SSL, if: running_ssl? do
 
       context 'both as a file and as object parameter' do
 
-        let(:options) do
+        let(:ssl_options) do
           super().merge(
-            :ssl_ca_cert => CA_PEM,
+            :ssl_ca_cert => SpecConfig.instance.local_ca_cert_path,
             :ssl_ca_cert_object => 'This is a string, not an array of certificates',
             :ssl_verify => true
           )
         end
 
-        before do
-          socket.connect!
-        end
-
         it 'discards the value of :ssl_ca_cert_object' do
           expect(socket).to be_alive
         end
@@ -401,8 +484,8 @@ describe Mongo::Socket::SSL, if: running_ssl? do
 
       context 'both as a PEM-encoded string and as object parameter' do
 
-        let(:options) do
-          cert = File.read(CA_PEM)
+        let(:ssl_options) do
+          cert = File.read(SpecConfig.instance.local_ca_cert_path)
           super().merge(
             :ssl_ca_cert_string => cert,
             :ssl_ca_cert_object => 'This is a string, not an array of certificates',
@@ -410,27 +493,91 @@ describe Mongo::Socket::SSL, if: running_ssl? do
           )
         end
 
-        before do
-          socket.connect!
-        end
-
         it 'discards the value of :ssl_ca_cert_object' do
           expect(socket).to be_alive
         end
       end
     end
 
-    context 'when a CA certificate is not provided', if: testing_ssl_locally? do
+    context 'when CA certificate file is not what server cert is signed with' do
+      require_local_tls
+
+      let(:server) do
+        ClientRegistry.instance.global_client('authorized').cluster.next_primary
+      end
+
+      let(:connection) do
+        Mongo::Server::Connection.new(server, ssl_options.merge(socket_timeout: 2))
+      end
+
+      context 'as a file' do
+        let(:ssl_options) do
+          SpecConfig.instance.test_options.merge(
+            ssl: true,
+            ssl_cert: SpecConfig.instance.client_cert_path,
+            ssl_key: SpecConfig.instance.client_key_path,
+            ssl_ca_cert: SpecConfig.instance.ssl_certs_dir.join('python-ca.crt').to_s,
+            ssl_verify: true,
+          )
+        end
+
+        it 'fails' do
+          connection
+          expect do
+            connection.connect!
+          end.to raise_error(Mongo::Error::SocketError, /SSLError/)
+        end
+      end
+    end
+
+    context 'when CA certificate file contains multiple certificates' do
+      require_local_tls
+
+      let(:server) do
+        ClientRegistry.instance.global_client('authorized').cluster.next_primary
+      end
+
+      let(:connection) do
+        Mongo::Server::Connection.new(server, ssl_options.merge(socket_timeout: 2))
+      end
+
+      context 'as a file' do
+        let(:ssl_options) do
+          SpecConfig.instance.test_options.merge(
+            ssl: true,
+            ssl_cert: SpecConfig.instance.client_cert_path,
+            ssl_key: SpecConfig.instance.client_key_path,
+            ssl_ca_cert: SpecConfig.instance.multi_ca_path,
+            ssl_verify: true,
+          )
+        end
+
+        it 'succeeds' do
+          connection
+          expect do
+            connection.connect!
+          end.not_to raise_error
+        end
+      end
+    end
+
+    context 'when a CA certificate is not provided' do
+      require_local_tls
 
-      let(:options) do
+      let(:ssl_options) do
         super().merge(
           :ssl_verify => true
         )
       end
 
-      before do
-        ENV['SSL_CERT_FILE']= CA_PEM
-        socket.connect!
+      around do |example|
+        saved = ENV['SSL_CERT_FILE']
+        ENV['SSL_CERT_FILE'] = SpecConfig.instance.local_ca_cert_path
+        begin
+          example.run
+        ensure
+          ENV['SSL_CERT_FILE'] = saved
+        end
       end
 
       it 'uses the default cert store' do
@@ -438,16 +585,151 @@ describe Mongo::Socket::SSL, if: running_ssl? do
       end
     end
 
-    context 'when ssl_verify is not specified', if: testing_ssl_locally? do
+    context 'when the client certificate uses an intermediate certificate' do
+      require_local_tls
 
-      let(:options) do
-        super().merge(
-          :ssl_ca_cert => CA_PEM
-        ).tap { |options| options.delete(:ssl_verify) }
+      let(:server) do
+        ClientRegistry.instance.global_client('authorized').cluster.next_primary
       end
 
-      before do
-        socket.connect!
+      let(:connection) do
+        Mongo::Server::Connection.new(server, ssl_options.merge(socket_timeout: 2))
+      end
+
+      context 'as a path to a file' do
+        context 'standalone' do
+          let(:ssl_options) do
+            SpecConfig.instance.test_options.merge(
+              ssl_cert: SpecConfig.instance.second_level_cert_path,
+              ssl_key: SpecConfig.instance.second_level_key_path,
+              ssl_ca_cert: SpecConfig.instance.local_ca_cert_path,
+              ssl_verify: true,
+            )
+          end
+
+          it 'fails' do
+            # This test provides a second level client certificate to the
+            # server *without* providing the intermediate certificate.
+            # If the server performs certificate verification, it will
+            # reject the connection (seen from the driver as a SocketError)
+            # and the test will succeed. If the server does not perform
+            # certificate verification, it will accept the connection,
+            # no SocketError will be raised and the test will fail.
+            connection
+            expect do
+              connection.connect!
+            end.to raise_error(Mongo::Error::SocketError)
+          end
+        end
+
+        context 'bundled with intermediate cert' do
+
+          # https://github.com/jruby/jruby-openssl/issues/181
+          require_mri
+
+          let(:ssl_options) do
+            SpecConfig.instance.test_options.merge(
+              ssl: true,
+              ssl_cert: SpecConfig.instance.second_level_cert_bundle_path,
+              ssl_key: SpecConfig.instance.second_level_key_path,
+              ssl_ca_cert: SpecConfig.instance.local_ca_cert_path,
+              ssl_verify: true,
+            )
+          end
+
+          it 'succeeds' do
+            connection
+            expect do
+              connection.connect!
+            end.not_to raise_error
+          end
+        end
+      end
+
+      context 'as a string' do
+        context 'standalone' do
+          let(:ssl_options) do
+            SpecConfig.instance.test_options.merge(
+              ssl_cert: nil,
+              ssl_cert_string: File.read(SpecConfig.instance.second_level_cert_path),
+              ssl_key: nil,
+              ssl_key_string: File.read(SpecConfig.instance.second_level_key_path),
+              ssl_ca_cert: SpecConfig.instance.local_ca_cert_path,
+              ssl_verify: true,
+            )
+          end
+
+          it 'fails' do
+            connection
+            expect do
+              connection.connect!
+            end.to raise_error(Mongo::Error::SocketError)
+          end
+        end
+
+        context 'bundled with intermediate cert' do
+
+          # https://github.com/jruby/jruby-openssl/issues/181
+          require_mri
+
+          let(:ssl_options) do
+            SpecConfig.instance.test_options.merge(
+              ssl: true,
+              ssl_cert: nil,
+              ssl_cert_string: File.read(SpecConfig.instance.second_level_cert_bundle_path),
+              ssl_key: nil,
+              ssl_key_string: File.read(SpecConfig.instance.second_level_key_path),
+              ssl_ca_cert: SpecConfig.instance.local_ca_cert_path,
+              ssl_verify: true,
+            )
+          end
+
+          it 'succeeds' do
+            connection
+            expect do
+              connection.connect!
+            end.not_to raise_error
+          end
+        end
+      end
+    end
+
+    context 'when client certificate and private key are bunded in a pem file' do
+      require_local_tls
+
+      let(:server) do
+        ClientRegistry.instance.global_client('authorized').cluster.next_primary
+      end
+
+      let(:connection) do
+        Mongo::Server::Connection.new(server, ssl_options.merge(socket_timeout: 2))
+      end
+
+      let(:ssl_options) do
+        SpecConfig.instance.ssl_options.merge(
+          ssl: true,
+          ssl_cert: SpecConfig.instance.client_pem_path,
+          ssl_key: SpecConfig.instance.client_pem_path,
+          ssl_ca_cert: SpecConfig.instance.local_ca_cert_path,
+          ssl_verify: true,
+        )
+      end
+
+      it 'succeeds' do
+        connection
+        expect do
+          connection.connect!
+        end.not_to raise_error
+      end
+    end
+
+    context 'when ssl_verify is not specified' do
+      require_local_tls
+
+      let(:ssl_options) do
+        super().merge(
+          :ssl_ca_cert => SpecConfig.instance.local_ca_cert_path
+        ).tap { |options| options.delete(:ssl_verify) }
       end
 
       it 'verifies the server certificate' do
@@ -455,19 +737,16 @@ describe Mongo::Socket::SSL, if: running_ssl? do
       end
     end
 
-    context 'when ssl_verify is true', if: testing_ssl_locally? do
+    context 'when ssl_verify is true' do
+      require_local_tls
 
-      let(:options) do
+      let(:ssl_options) do
         super().merge(
-          :ssl_ca_cert => CA_PEM,
+          :ssl_ca_cert => SpecConfig.instance.local_ca_cert_path,
           :ssl_verify => true
         )
       end
 
-      before do
-        socket.connect!
-      end
-
       it 'verifies the server certificate' do
         expect(socket).to be_alive
       end
@@ -475,19 +754,27 @@ describe Mongo::Socket::SSL, if: running_ssl? do
 
     context 'when ssl_verify is false' do
 
-      let(:options) do
+      let(:ssl_options) do
         super().merge(
           :ssl_ca_cert => 'invalid',
           :ssl_verify => false
         )
       end
 
+      it 'does not verify the server certificate' do
+        expect(socket).to be_alive
+      end
+    end
+
+    context 'when OpenSSL allows disabling renegotiation 'do
       before do
-        socket.connect!
+        unless OpenSSL::SSL.const_defined?(:OP_NO_RENEGOTIATION)
+          skip 'OpenSSL::SSL::OP_NO_RENEGOTIATION is not defined'
+        end
       end
 
-      it 'does not verify the server certificate' do
-        expect(socket).to be_alive
+      it 'disables TLS renegotiation' do
+        expect(socket.context.options & OpenSSL::SSL::OP_NO_RENEGOTIATION).to eq(OpenSSL::SSL::OP_NO_RENEGOTIATION)
       end
     end
   end
@@ -524,9 +811,13 @@ describe Mongo::Socket::SSL, if: running_ssl? do
 
       let(:socket_content) { "" }
 
+      let(:remote_address) { socket.instance_variable_get(:@tcp_socket).remote_address }
+      let(:address_str) { "#{remote_address.ip_address}:#{remote_address.ip_port} (#{default_address}, TLS)" }
+
       it 'should raise EOFError' do
-        expect { socket.readbyte }
-          .to raise_error(Mongo::Error::SocketError).with_message("EOFError")
+        expect do
+          socket.readbyte
+        end.to raise_error(Mongo::Error::SocketError).with_message("EOFError: EOFError (for #{address_str})")
       end
     end
   end