ssl: remove OpenSSL::X509::V_FLAG_CRL_CHECK_ALL from the default store

[rhenium]

With OpenSSL 3.6.0, it causes nearly every certificate verification to fail with the message certificate verify failed (unable to get certificate CRL) because the CRLs are typically unavailable in the default store used by OpenSSL::SSL::SSLContext#set_params.

OpenSSL::X509::V_FLAG_CRL_CHECK_ALL is a flag that extends the CRL checking to all certificates in the chain. In OpenSSL < 3.6.0, the flag alone has no effect, and OpenSSL::X509::V_FLAG_CRL_CHECK must also be set to enable CRL checking.

In OpenSSL 3.6.0, OpenSSL::X509::V_FLAG_CRL_CHECK_ALL now implies OpenSSL::X509::V_FLAG_CRL_CHECK. This is inconsistent with the man page and may be fixed in a future OpenSSL 3.6.x release, but this flag is not needed and should not be set by default.

Fixes #949

[junaruga]

Thank you for the PR!

Seeing the master branch commits, CI passed at my commit fcf2889, which added OpenSSL 3.6.0. Then I see the CI failed at the merge commit 7f4886b. It seems that this PR fixes the failures on the CI. Do you know why the failures didn't happen at the commit fcf2889?

https://github.com/ruby/openssl/commits/master/

[rhenium]

It's an issue in https://github.com/ruby/test-unit-ruby-core with Ruby < 3.3, which was released to rubygems.org just before I pushed the merge button.

This PR is for maint-3.1 and doesn't use the gem yet.

[junaruga]

It's an issue in https://github.com/ruby/test-unit-ruby-core with Ruby < 3.3, which was released to rubygems.org just before I pushed the merge button.

This PR is for maint-3.1 and doesn't use the gem yet.

Ah, all right. I misunderstood this PR was for the master branch.

The test-unit-ruby-core 1.0.8 caused the failures.
https://github.com/ruby/openssl/actions/runs/18215689022/job/51864349455#step:5:100

But today test-unit-ruby-core 1.0.9 was released, and I see the CI passed again at the commit 64f4aae.

https://rubygems.org/gems/test-unit-ruby-core

[htrungngx]

This will nerver finish because some 20.04 runners are still in-use

[junaruga]

This will nerver finish because some 20.04 runners are still in-use

I think we understand the situation. We dropped Ubuntu 20.04 image on the master branch in the past by the commit fe4319c. But we haven't applied the change to the maint-3.1 branch.

[jbourassa]

Thanks for this fix. Going to paste the exact error message here so that folks Googling can find this fix:

certificate verify failed (unable to get certificate CRL) (OpenSSL::SSL::SSLError)