Elixir :ssl certificate validation failures with custom CA bundles

Answer to the questions

1. Prioritization of CA sources

• If cacertfile or cacerts is supplied in the SSL options, Erlang uses those PEM certificates exclusively; the system CA store is ignored.
• If both explicit options and the system store are present, the explicit options win. The system store is consulted only when no explicit cacertfile or cacerts is specified.
• When no explicit CA option is given, the default system store (e.g., /etc/ssl/certs on Linux, /etc/ssl/cert.pem on macOS, or the Windows store) is used.

2. Updating the CA bundle dynamically

• On OTP 20 and later, you can change the CA bundle without stopping the node by recreating the SSL socket or by calling :ssl.set_options/2 on an existing listening socket. The new options will be applied to all new connections and, for listening sockets, to existing connections that are re‑accepted.
• For long‑running client connections that keep sockets open, the common pattern is to supervise a helper process that watches the bundle file. When the file changes, the helper calls :ssl.set_options/2 on the socket or forces a reconnect.
• On OTP releases prior to 20, the only way to pick up a new bundle is to close and reopen the socket (or restart the node). In those cases, a graceful restart of the supervised application is required.

Recommended steps for a typical Elixir application

1. Store the bundle: Keep your custom CA bundle in a path that your application can read, e.g., priv/certs/root.pem.
2. Configure the connection:

   ssl_opts = [
         cacertfile: Path.expand("priv/certs/root.pem", Mix.env() |> to_string()),
         verify: :verify_peer,
         depth: 5
       ]
       :ssl.connect(:example.com, 443, ssl_opts, 5000)
       

3. Dynamic reload:
   • Wrap the connection logic in a GenServer that keeps the socket in its state.
   • Use FileSystem or fs to watch root.pem for changes.
   • When a change is detected, call :ssl.set_options(socket, [cacertfile: new_path]) or simply close the socket and let the GenServer open a new one.
4. Verify the update:
   • After the change, make a new request and check that IO.inspect(:ssl.connection_info(socket, :peer_certificate)) returns the expected cert.
   • Use IO.inspect(:ssl.connection_info(socket, :peer_certificate)) before and after the reload to confirm the new CA bundle is in effect.

What to check first

Confirm the OTP release your node is running. The dynamic :ssl.set_options/2 approach requires OTP 20 or newer. If you’re on an earlier release, you’ll need to restart the socket or the whole node to pick up a new bundle.

Could you let me know which OTP version your application is using? That will determine whether the :ssl.set_options/2 method is available for your sockets.