fix: VAULT_SKIP_VERIFY=false turns TLS verification off

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+BUG FIXES
+
+- Read `VAULT_SKIP_VERIFY` and `VAULT_SSL_VERIFY` as booleans, like the Vault CLI. Before, any value of `VAULT_SKIP_VERIFY`, also `false` or `0`, turned TLS verification off, and `VAULT_SSL_VERIFY=1` turned it off too. A value that is not a boolean now keeps verification on.
+
 ## v0.20.1 (March 31, 2026)
 
 BUG FIXES

lib/vault/defaults.rb

@@ -189,15 +189,22 @@ def ssl_ca_path
       # Verify SSL requests (default: true)
       # @return [true, false]
       def ssl_verify
-        # Vault CLI uses this envvar, so accept it by precedence
-        if !ENV["VAULT_SKIP_VERIFY"].nil?
-          return false
-        end
-
-        if ENV["VAULT_SSL_VERIFY"].nil?
-          true
-        else
-          %w[t y].include?(ENV["VAULT_SSL_VERIFY"].downcase[0])
+        # Vault CLI uses this envvar, so accept it by precedence. Like the CLI,
+        # read it as a boolean: VAULT_SKIP_VERIFY=false keeps verification on.
+        skip = env_boolean("VAULT_SKIP_VERIFY")
+        return !skip unless skip.nil?
+
+        verify = env_boolean("VAULT_SSL_VERIFY")
+        verify.nil? ? true : verify
+      end
+
+      # The boolean value of an environment variable, or nil when it is unset
+      # or not a boolean, so that an unknown value never turns off verification.
+      # @return [true, false, nil]
+      def env_boolean(name)
+        case ENV[name].to_s.strip.downcase
+        when "1", "t", "true", "y", "yes" then true
+        when "0", "f", "false", "n", "no" then false
         end
       end
 

spec/unit/defaults_spec.rb

@@ -261,6 +261,36 @@ module Vault
           expect(Defaults.ssl_verify).to be(false)
         end
       end
+
+      %w[false FALSE f F 0].each do |value|
+        it "verifies when ENV['VAULT_SKIP_VERIFY'] is #{value.inspect}, as the Vault CLI does" do
+          with_stubbed_env("VAULT_SKIP_VERIFY" => value) do
+            expect(Defaults.ssl_verify).to be(true)
+          end
+        end
+      end
+
+      %w[true TRUE t T 1].each do |value|
+        it "skips verification when ENV['VAULT_SKIP_VERIFY'] is #{value.inspect}" do
+          with_stubbed_env("VAULT_SKIP_VERIFY" => value) do
+            expect(Defaults.ssl_verify).to be(false)
+          end
+        end
+      end
+
+      ["", "maybe"].each do |value|
+        it "verifies when ENV['VAULT_SKIP_VERIFY'] is not a boolean (#{value.inspect})" do
+          with_stubbed_env("VAULT_SKIP_VERIFY" => value) do
+            expect(Defaults.ssl_verify).to be(true)
+          end
+        end
+      end
+
+      it "verifies when ENV['VAULT_SSL_VERIFY'] is \"1\"" do
+        with_stubbed_env("VAULT_SSL_VERIFY" => "1") do
+          expect(Defaults.ssl_verify).to be(true)
+        end
+      end
     end
 
     describe ".ssl_timeout" do