Fix memory leak in OpenSSL::SSL::Socket#peer_certificate

[compumike]

While opening lots of HTTPS connections (from Heii On-Call outbound prober processes for website monitoring / alerting), I discovered a substantial memory leak. This memory leak causes our processes to hit their memory limits and restart several times per day. I traced the leak down to a call to OpenSSL::SSL::Socket#peer_certificate, which we recently started using to inspect SSL certificate expiry dates, so we can warn our users about soon-to-expire certificates.

As per https://www.openssl.org/docs/man3.1/man3/SSL_get1_peer_certificate.html :

The reference count of the X509 object returned by SSL_get1_peer_certificate() is incremented by one, so that it will not be destroyed when the session containing the peer certificate is freed. The X509 object must be explicitly freed using X509_free().

The attached fix ensures that the raw LibCrypto::X509 certificate is freed with LibCrypto.x509_free after it is LibCrypto.x509_dup'd into a new OpenSSL::X509::Certificate instance within the OpenSSL::X509::Certificate constructor.

Running with this change monkeypatched does fix our memory leak. 😄

[crysbot]

This pull request has been mentioned on Crystal Forum. There might be relevant details there:

https://forum.crystal-lang.org/t/how-can-i-get-the-expiration-date-of-an-ssl-certificate-in-crystal/6710/5