Ruby: How to connect to a host with expired SSL certificate

If you need to make an HTTPS connection to a host which uses an expired certificate, do not disable certificate verifications entirely. Doing that enables e.g. man in the middle attacks.
If you accept only a single expired and known certificate, you are much less in trouble.

Setup

All the solutions described below use a verify_callback for the request's OpenSSL::X509::Store where you can specify a lambda to adjust its verification response.
Your callback must return either true or false and OpenSSL's verification result is the first callback block argument.

In our examples, we will be connecting to expired.badssl.com which uses an expired certificate.
The certificate is also a wildcard certificate, so its Common Name property (CN) is set to *.badssl.com.

Our verify_callback will allow connecting to an expired host only when its certificate contains CN=*.badssl.com.

Copyuri = URI.parse('https://expired.badssl.com')
expected_common_name = '*.badssl.com'

verify_callback = lambda do |preverify_ok, store_context|
  if store_context.error == OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED && store_context.current_cert.subject.to_s.include?("CN=#{expected_common_name}")
    # The certiciate for that host is expired, but it's fine for us.
    true
  else
    preverify_ok 
  end
end

Using that is fairly straightforward in your favorite connection library. We've described a few below.

Net::HTTP

Ruby's Net::HTTP requires the longest setup of all:

Copyrequire 'net/https'

http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
http.verify_mode = OpenSSL::SSL::VERIFY_PEER
http.verify_callback = verify_callback

get = Net::HTTP::Get.new(uri.request_uri)
response = http.request(get)
puts response.body

HTTP

Using the http Show archive.org snapshot gem, you can pass along the verify_callback as an option like so:

Copyrequire 'http'

response = HTTP.get(uri, ssl: { verify_callback: verify_callback })
puts response.body

RestClient

The rest-client Show archive.org snapshot gem also offers an ssl_verify_callback option, but not for its top-level utility methods, like RestClient.get.
Instead, you can use a RestClient::Resource.new like so:

Copyrequire 'rest-client'

resource = RestClient::Resource.new(uri.to_s, ssl_verify_callback: verify_callback)
puts resource.get