wrap OpenSSL exceptions in Faraday's own SSLError class

lib/faraday/adapter/excon.rb

@@ -58,6 +58,8 @@ module Faraday
       rescue ::Excon::Errors::SocketError => err
         if err.message =~ /\btimeout\b/
           raise Error::TimeoutError, err
+        elsif err.message =~ /\bcertificate\b/
+          raise Faraday::SSLError, err
         else
           raise Error::ConnectionFailed, err
         end

lib/faraday/adapter/httpclient.rb

@@ -47,6 +47,12 @@ module Faraday
         end
       rescue Errno::ECONNREFUSED
         raise Faraday::Error::ConnectionFailed, $!
+      rescue => err
+        if defined?(OpenSSL) && OpenSSL::SSL::SSLError === err
+          raise Faraday::SSLError, err
+        else
+          raise
+        end
       end
 
       def configure_socket(bind)

lib/faraday/adapter/net_http.rb

@@ -36,8 +36,12 @@ module Faraday
 
         begin
           http_response = perform_request(http, env)
-        rescue *NET_HTTP_EXCEPTIONS
-          raise Error::ConnectionFailed, $!
+        rescue *NET_HTTP_EXCEPTIONS => err
+          if defined?(OpenSSL) && OpenSSL::SSL::SSLError === err
+            raise Faraday::SSLError, err
+          else
+            raise Error::ConnectionFailed, err
+          end
         end
 
         save_response(env, http_response.code.to_i, http_response.body || '') do |response_headers|

lib/faraday/adapter/typhoeus.rb

@@ -61,6 +61,8 @@ module Faraday
             # everything OK
           when 7
             raise Error::ConnectionFailed, resp.curl_error_message
+          when 60
+            raise Faraday::SSLError, resp.curl_error_message
           else
             raise Error::ClientError, resp.curl_error_message
           end

lib/faraday/error.rb

@@ -38,8 +38,11 @@ module Faraday
   class ParsingError     < ClientError;   end
   class TimeoutError < ClientError; end
 
+  class SSLError < ClientError
+  end
+
   [:MissingDependency, :ClientError, :ConnectionFailed, :ResourceNotFound,
-   :ParsingError, :TimeoutError].each do |const|
+   :ParsingError, :TimeoutError, :SSLError].each do |const|
     Error.const_set(const, Faraday.const_get(const))
   end
 end

test/adapters/integration.rb

@@ -12,6 +12,7 @@ module Adapters
       if base.live_server?
         features = [:Common]
         features.concat extra_features
+        features << :SSL if base.ssl_mode?
         features.each {|name| base.send(:include, self.const_get(name)) }
         yield if block_given?
       elsif !defined? @warned
@@ -62,6 +63,17 @@ module Adapters
       end
     end
 
+    module SSL
+      def test_GET_ssl_fails_with_bad_cert
+        ca_file = 'tmp/faraday-different-ca-cert.crt'
+        conn = create_connection(:ssl => {:ca_file => ca_file})
+        err = assert_raises Faraday::SSLError do
+          conn.get('/ssl')
+        end
+        assert_includes err.message, "certificate"
+      end
+    end
+
     module Common
       extend Forwardable
       def_delegators :create_connection, :get, :head, :put, :post, :patch, :delete, :run_request

test/adapters/net_http_persistent_test.rb

@@ -5,7 +5,16 @@ module Adapters
 
     def adapter() :net_http_persistent end
 
-    Integration.apply(self, :NonParallel)
+    Integration.apply(self, :NonParallel) do
+      def setup
+        if defined?(Net::HTTP::Persistent)
+          # work around problems with mixed SSL certificates
+          # https://github.com/drbrain/net-http-persistent/issues/45
+          http = Net::HTTP::Persistent.new('Faraday')
+          http.ssl_cleanup(4)
+        end
+      end if ssl_mode?
+    end
 
   end
 end

test/adapters/typhoeus_test.rb

@@ -22,19 +22,6 @@ module Adapters
         assert_equal host, conn.options[:bind][:host]
       end
 
-      def test_GET_ssl_rejects_bad_hosts
-        original_ssl_file = ENV['SSL_FILE']
-        begin
-          ENV['SSL_FILE'] = 'tmp/faraday-different-ca-cert.crt'
-          conn = create_connection
-          expected = ''
-          response = conn.get('/ssl')
-          assert_equal expected, response.body
-        ensure
-          ENV['SSL_FILE'] = original_ssl_file
-        end
-      end if ssl_mode?
-
     end unless jruby?
   end
 end