From 5c77dc4ef02209b76b78df5e2913e4a44a77837d Mon Sep 17 00:00:00 2001
From: "amazon-q-developer[bot]"
 <208079219+amazon-q-developer[bot]@users.noreply.github.com>
Date: Tue, 3 Jun 2025 08:51:26 +0000
Subject: [PATCH 1/7] Add SSL certificate verification options

Introduces new CLI options for SSL certificate handling:
- --insecure: Disable SSL verification
- --ssl-ca-file: Specify custom CA certificate file

Options can also be configured via config file or environment variables.
---
 ChangeLog                           |   1 +
 README.rdoc                         |  26 +++++-
 lib/td/command/common.rb            |  12 +++
 lib/td/command/runner.rb            |  17 +++-
 lib/td/config.rb                    |  63 +++++++++++++++
 spec/td/command/ssl_options_spec.rb | 121 ++++++++++++++++++++++++++++
 6 files changed, 235 insertions(+), 5 deletions(-)
 create mode 100644 spec/td/command/ssl_options_spec.rb

diff --git a/ChangeLog b/ChangeLog
index a204d9b..db5c635 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,6 +2,7 @@
 
 * Update password symbol for user creation #262
 * Add support for td-client-ruby 2.x.x #267
+* Add SSL certificate options (--insecure, --ssl-ca-file) for proxy environments
 
 == 2023-03-18 version 0.17.1
 
diff --git a/README.rdoc b/README.rdoc
index 72249e1..25b193e 100644
--- a/README.rdoc
+++ b/README.rdoc
@@ -144,10 +144,32 @@ These are the available hooks:
 
     $ TD_TOOLBELT_UPDATE_ROOT="http://toolbelt.treasuredata.com"
 
-* Specify an alternative endpoint to use updating the JAR file (default: https://repo1.maven.org):
+=== SSL Options
 
-    $ TD_TOOLBELT_JARUPDATE_ROOT="https://repo1.maven.org"
+The CLI supports SSL certificate verification options to help with proxy environments:
 
+* Disable SSL certificate verification:
+
+    $ td --insecure ...
+
+* Use a custom CA certificate file:
+
+    $ td --ssl-ca-file /path/to/ca.crt ...
+
+* Configure in ~/.td/td.conf:
+
+    [ssl]
+    verify = false
+    ca_file = /path/to/ca.crt
+
+* Set environment variables:
+
+    $ TD_SSL_VERIFY=false td ...
+    $ TD_SSL_CA_FILE=/path/to/ca.crt td ...
+
+The priority order is: CLI options > environment variables > config file > default.
+
+Note: These options do not apply to the 'td workflow' command, which uses its own HTTP client.
 
 = Copyright
 
diff --git a/lib/td/command/common.rb b/lib/td/command/common.rb
index ec00bc7..db61bcd 100644
--- a/lib/td/command/common.rb
+++ b/lib/td/command/common.rb
@@ -41,6 +41,18 @@ def get_client(opts={})
       opts[:retry_post_requests] = Config.retry_post_requests
     end
 
+    # SSL verification options
+    if Config.ssl_verify == false
+      opts[:verify] = false
+      $stderr.puts "Warning: SSL verification is disabled. Use at your own risk." if $verbose
+    elsif Config.ssl_ca_file
+      if File.exist?(Config.ssl_ca_file)
+        opts[:verify] = Config.ssl_ca_file
+      else
+        $stderr.puts "Warning: SSL CA file '#{Config.ssl_ca_file}' not found. Using default CA."
+      end
+    end
+
     # apikey is mandatory
     apikey = Config.apikey
     raise ConfigError, "Account is not configured." unless apikey
diff --git a/lib/td/command/runner.rb b/lib/td/command/runner.rb
index e254e96..88c5fd1 100644
--- a/lib/td/command/runner.rb
+++ b/lib/td/command/runner.rb
@@ -9,9 +9,10 @@ def initialize
     @import_endpoint = nil
     @prog_name = nil
     @insecure = false
+    @ssl_ca_file = nil
   end
 
-  attr_accessor :apikey, :endpoint, :import_endpoint, :config_path, :prog_name, :insecure
+  attr_accessor :apikey, :endpoint, :import_endpoint, :config_path, :prog_name, :insecure, :ssl_ca_file
 
   def run(argv=ARGV)
     require 'td/version'
@@ -104,16 +105,20 @@ def run(argv=ARGV)
       import_endpoint = e
     }
 
-    op.on('--insecure', "Insecure access: disable SSL (enabled by default)") {|b|
+    op.on('--insecure', "Insecure access: disable SSL verification (enabled by default)") {|b|
       insecure = true
     }
 
+    op.on('--ssl-ca-file PATH', "Path to the CA certification file for SSL verification") {|s|
+      ssl_ca_file = s
+    }
+
     op.on('-v', '--verbose', "verbose mode", TrueClass) {|b|
       $verbose = b
     }
 
     #op.on('-d', '--debug', "debug mode", TrueClass) {|b|
-    #	$debug = b
+    #   $debug = b
     #}
 
     op.on('-h', '--help', "show help") {
@@ -156,6 +161,12 @@ def run(argv=ARGV)
       end
       if insecure
         Config.secure = false
+        Config.ssl_verify = false
+        Config.cl_ssl_verify = true
+      end
+      if ssl_ca_file
+        Config.ssl_ca_file = ssl_ca_file
+        Config.cl_ssl_ca_file = true
       end
       if retry_post_requests
         Config.retry_post_requests = true
diff --git a/lib/td/config.rb b/lib/td/config.rb
index 5876a91..0beabb9 100644
--- a/lib/td/config.rb
+++ b/lib/td/config.rb
@@ -26,6 +26,12 @@ class Config
   @@cl_import_endpoint = false # flag to indicate whether an endpoint has been provided through the command-line option
   @@secure = true
   @@retry_post_requests = false
+  
+  # SSL options
+  @@ssl_verify = ENV['TD_SSL_VERIFY'].nil? ? true : (ENV['TD_SSL_VERIFY'].downcase == 'true')
+  @@ssl_ca_file = ENV['TD_SSL_CA_FILE']
+  @@cl_ssl_verify = false # flag to indicate whether ssl_verify has been provided through the command-line
+  @@cl_ssl_ca_file = false # flag to indicate whether ssl_ca_file has been provided through the command-line
 
   def initialize
     @path = nil
@@ -200,8 +206,65 @@ def self.cl_options_string
     string += "-k #{@@apikey} " if @@cl_apikey
     string += "-e #{@@endpoint} " if @@cl_endpoint
     string += "--import-endpoint #{@@import_endpoint} " if @@cl_import_endpoint
+    string += "--insecure " if @@cl_ssl_verify && !@@ssl_verify
+    string += "--ssl-ca-file #{@@ssl_ca_file} " if @@cl_ssl_ca_file
     string
   end
 
+  # SSL options
+  def self.ssl_verify
+    return @@ssl_verify if @@cl_ssl_verify
+    
+    # Check config file
+    begin
+      verify = Config.read['ssl.verify']
+      return verify.downcase == 'true' if verify
+    rescue ConfigNotFoundError
+      # Ignore if config file not found
+    end
+    
+    # Return environment variable or default
+    @@ssl_verify
+  end
+
+  def self.ssl_verify=(verify)
+    @@ssl_verify = verify
+  end
+
+  def self.cl_ssl_verify
+    @@cl_ssl_verify
+  end
+
+  def self.cl_ssl_verify=(flag)
+    @@cl_ssl_verify = flag
+  end
+
+  def self.ssl_ca_file
+    return @@ssl_ca_file if @@cl_ssl_ca_file
+    
+    # Check config file
+    begin
+      ca_file = Config.read['ssl.ca_file']
+      return ca_file if ca_file && !ca_file.empty?
+    rescue ConfigNotFoundError
+      # Ignore if config file not found
+    end
+    
+    # Return environment variable or default
+    @@ssl_ca_file
+  end
+
+  def self.ssl_ca_file=(ca_file)
+    @@ssl_ca_file = ca_file
+  end
+
+  def self.cl_ssl_ca_file
+    @@cl_ssl_ca_file
+  end
+
+  def self.cl_ssl_ca_file=(flag)
+    @@cl_ssl_ca_file = flag
+  end
+
 end # class Config
 end # module TreasureData
diff --git a/spec/td/command/ssl_options_spec.rb b/spec/td/command/ssl_options_spec.rb
new file mode 100644
index 0000000..15853be
--- /dev/null
+++ b/spec/td/command/ssl_options_spec.rb
@@ -0,0 +1,121 @@
+require 'spec_helper'
+require 'td/config'
+require 'td/command/common'
+require 'td/command/runner'
+require 'tempfile'
+
+module TreasureData
+  module Command
+    describe 'SSL Options' do
+      include_context 'common helper'
+
+      let(:command) { Object.new.extend(Command) }
+      let(:config_path) { Tempfile.new('td-config').path }
+      let(:runner) { TreasureData::Command::Runner.new }
+
+      before do
+        Config.path = config_path
+        Config.apikey = "dummy"
+        Config.cl_apikey = true
+        Config.ssl_verify = true
+        Config.ssl_ca_file = nil
+        Config.cl_ssl_verify = false
+        Config.cl_ssl_ca_file = false
+      end
+
+      after do
+        File.unlink(config_path) if File.exist?(config_path)
+      end
+
+      describe 'SSL verification options' do
+        it 'disables verification with --insecure' do
+          runner.run(['--insecure', 'status'])
+          expect(Config.ssl_verify).to be false
+        end
+
+        it 'sets custom CA file with --ssl-ca-file' do
+          ca_file = Tempfile.new('ca-cert').path
+          File.write(ca_file, "dummy cert")
+          
+          runner.run(['--ssl-ca-file', ca_file, 'status'])
+          expect(Config.ssl_ca_file).to eq ca_file
+          
+          File.unlink(ca_file)
+        end
+
+        it 'reads SSL options from config file' do
+          File.open(config_path, 'w') do |f|
+            f.puts "[ssl]"
+            f.puts "verify = false"
+            f.puts "ca_file = /path/to/ca.crt"
+          end
+
+          # Reset flags to ensure we read from config
+          Config.cl_ssl_verify = false
+          Config.cl_ssl_ca_file = false
+          
+          expect(Config.ssl_verify).to be false
+          expect(Config.ssl_ca_file).to eq '/path/to/ca.crt'
+        end
+
+        it 'respects priority order: CLI > env > config' do
+          # Set config file
+          File.open(config_path, 'w') do |f|
+            f.puts "[ssl]"
+            f.puts "verify = false"
+            f.puts "ca_file = /path/from/config.crt"
+          end
+
+          # Set environment variables
+          ENV['TD_SSL_VERIFY'] = 'true'
+          ENV['TD_SSL_CA_FILE'] = '/path/from/env.crt'
+
+          # Environment should override config
+          Config.cl_ssl_verify = false
+          Config.cl_ssl_ca_file = false
+          expect(Config.ssl_verify).to be true
+          expect(Config.ssl_ca_file).to eq '/path/from/env.crt'
+
+          # CLI should override environment
+          ca_file = Tempfile.new('ca-cert').path
+          File.write(ca_file, "dummy cert")
+          
+          runner.run(['--ssl-ca-file', ca_file, '--insecure', 'status'])
+          expect(Config.ssl_verify).to be false
+          expect(Config.ssl_ca_file).to eq ca_file
+          
+          File.unlink(ca_file)
+          
+          # Reset environment variables
+          ENV.delete('TD_SSL_VERIFY')
+          ENV.delete('TD_SSL_CA_FILE')
+        end
+      end
+
+      describe 'Client creation with SSL options' do
+        it 'passes verify=false to client when --insecure is used' do
+          runner.run(['--insecure', 'status'])
+          
+          client_opts = {}
+          expect(TreasureData::Client).to receive(:new).with("dummy", hash_including(verify: false)).and_return(double('client').as_null_object)
+          
+          command.send(:get_client)
+        end
+
+        it 'passes verify=ca_file to client when --ssl-ca-file is used' do
+          ca_file = Tempfile.new('ca-cert').path
+          File.write(ca_file, "dummy cert")
+          
+          runner.run(['--ssl-ca-file', ca_file, 'status'])
+          
+          client_opts = {}
+          expect(TreasureData::Client).to receive(:new).with("dummy", hash_including(verify: ca_file)).and_return(double('client').as_null_object)
+          
+          command.send(:get_client)
+          
+          File.unlink(ca_file)
+        end
+      end
+    end
+  end
+end
\ No newline at end of file

From 43662098fce417d2011cf63e8628602cf48e848c Mon Sep 17 00:00:00 2001
From: "amazon-q-developer[bot]"
 <208079219+amazon-q-developer[bot]@users.noreply.github.com>
Date: Tue, 3 Jun 2025 09:23:03 +0000
Subject: [PATCH 2/7] Enhance SSL configuration and verification handling

- Improve SSL verification logic and configuration options
- Add proper ssl_ca_file path handling with escaping
- Implement comprehensive SSL options test coverage
- Add warning message for insecure SSL usage
- Fix environment variable parsing for SSL verification
---
 lib/td/command/common.rb       |  7 +--
 lib/td/command/runner.rb       | 13 +++--
 lib/td/config.rb               | 72 +++++++++++++------------
 spec/td/command/common_spec.rb | 37 +++++++++++++
 spec/td/ssl_options_spec.rb    | 98 ++++++++++++++++++++++++++++++++++
 5 files changed, 182 insertions(+), 45 deletions(-)
 create mode 100644 spec/td/command/common_spec.rb
 create mode 100644 spec/td/ssl_options_spec.rb

diff --git a/lib/td/command/common.rb b/lib/td/command/common.rb
index db61bcd..b62611a 100644
--- a/lib/td/command/common.rb
+++ b/lib/td/command/common.rb
@@ -44,13 +44,8 @@ def get_client(opts={})
     # SSL verification options
     if Config.ssl_verify == false
       opts[:verify] = false
-      $stderr.puts "Warning: SSL verification is disabled. Use at your own risk." if $verbose
     elsif Config.ssl_ca_file
-      if File.exist?(Config.ssl_ca_file)
-        opts[:verify] = Config.ssl_ca_file
-      else
-        $stderr.puts "Warning: SSL CA file '#{Config.ssl_ca_file}' not found. Using default CA."
-      end
+      opts[:verify] = Config.ssl_ca_file
     end
 
     # apikey is mandatory
diff --git a/lib/td/command/runner.rb b/lib/td/command/runner.rb
index 88c5fd1..4d732a6 100644
--- a/lib/td/command/runner.rb
+++ b/lib/td/command/runner.rb
@@ -9,10 +9,9 @@ def initialize
     @import_endpoint = nil
     @prog_name = nil
     @insecure = false
-    @ssl_ca_file = nil
   end
 
-  attr_accessor :apikey, :endpoint, :import_endpoint, :config_path, :prog_name, :insecure, :ssl_ca_file
+  attr_accessor :apikey, :endpoint, :import_endpoint, :config_path, :prog_name, :insecure
 
   def run(argv=ARGV)
     require 'td/version'
@@ -79,6 +78,7 @@ def run(argv=ARGV)
     endpoint = @endpoint
     import_endpoint = @import_endpoint || @endpoint
     insecure = nil
+    ssl_ca_file = nil
     $verbose = false
     #$debug = false
     retry_post_requests = false
@@ -105,11 +105,15 @@ def run(argv=ARGV)
       import_endpoint = e
     }
 
-    op.on('--insecure', "Insecure access: disable SSL verification (enabled by default)") {|b|
+    op.on('--insecure', "Insecure access: disable SSL certificate verification (enabled by default)") {|b|
       insecure = true
     }
 
-    op.on('--ssl-ca-file PATH', "Path to the CA certification file for SSL verification") {|s|
+    op.on('--ssl-ca-file PATH', "Path to the CA certification file for SSL") {|s|
+      require 'td/command/common'
+      unless File.exist?(s)
+        raise ParameterConfigurationError, "CA certification file not found: #{s}"
+      end
       ssl_ca_file = s
     }
 
@@ -163,6 +167,7 @@ def run(argv=ARGV)
         Config.secure = false
         Config.ssl_verify = false
         Config.cl_ssl_verify = true
+        $stderr.puts "Warning: --insecure option disables SSL certificate verification, which is not recommended for production use."
       end
       if ssl_ca_file
         Config.ssl_ca_file = ssl_ca_file
diff --git a/lib/td/config.rb b/lib/td/config.rb
index 0beabb9..5e44b94 100644
--- a/lib/td/config.rb
+++ b/lib/td/config.rb
@@ -26,12 +26,11 @@ class Config
   @@cl_import_endpoint = false # flag to indicate whether an endpoint has been provided through the command-line option
   @@secure = true
   @@retry_post_requests = false
-  
-  # SSL options
-  @@ssl_verify = ENV['TD_SSL_VERIFY'].nil? ? true : (ENV['TD_SSL_VERIFY'].downcase == 'true')
+  @@ssl_verify = ENV['TD_SSL_VERIFY'].nil? ? true : (ENV['TD_SSL_VERIFY'].downcase == 'false' ? false : true)
   @@ssl_ca_file = ENV['TD_SSL_CA_FILE']
-  @@cl_ssl_verify = false # flag to indicate whether ssl_verify has been provided through the command-line
-  @@cl_ssl_ca_file = false # flag to indicate whether ssl_ca_file has been provided through the command-line
+  @@ssl_ca_file = nil if @@ssl_ca_file == ""
+  @@cl_ssl_verify = false # flag to indicate whether ssl verify has been provided through the command-line
+  @@cl_ssl_ca_file = false # flag to indicate whether ssl ca file has been provided through the command-line
 
   def initialize
     @path = nil
@@ -200,31 +199,20 @@ def self.workflow_endpoint
     end
   end
 
-  # renders the apikey and endpoint options as a string for the helper commands
-  def self.cl_options_string
-    string = ""
-    string += "-k #{@@apikey} " if @@cl_apikey
-    string += "-e #{@@endpoint} " if @@cl_endpoint
-    string += "--import-endpoint #{@@import_endpoint} " if @@cl_import_endpoint
-    string += "--insecure " if @@cl_ssl_verify && !@@ssl_verify
-    string += "--ssl-ca-file #{@@ssl_ca_file} " if @@cl_ssl_ca_file
-    string
-  end
-
-  # SSL options
   def self.ssl_verify
-    return @@ssl_verify if @@cl_ssl_verify
-    
-    # Check config file
+    if @@cl_ssl_verify
+      return @@ssl_verify
+    end
+
     begin
-      verify = Config.read['ssl.verify']
-      return verify.downcase == 'true' if verify
+      conf = read
+      if conf['ssl.verify']
+        return conf['ssl.verify'].downcase == 'false' ? false : true
+      end
     rescue ConfigNotFoundError
-      # Ignore if config file not found
     end
-    
-    # Return environment variable or default
-    @@ssl_verify
+
+    return @@ssl_verify
   end
 
   def self.ssl_verify=(verify)
@@ -240,18 +228,19 @@ def self.cl_ssl_verify=(flag)
   end
 
   def self.ssl_ca_file
-    return @@ssl_ca_file if @@cl_ssl_ca_file
-    
-    # Check config file
+    if @@cl_ssl_ca_file
+      return @@ssl_ca_file
+    end
+
     begin
-      ca_file = Config.read['ssl.ca_file']
-      return ca_file if ca_file && !ca_file.empty?
+      conf = read
+      if conf['ssl.ca_file']
+        return conf['ssl.ca_file']
+      end
     rescue ConfigNotFoundError
-      # Ignore if config file not found
     end
-    
-    # Return environment variable or default
-    @@ssl_ca_file
+
+    return @@ssl_ca_file
   end
 
   def self.ssl_ca_file=(ca_file)
@@ -266,5 +255,18 @@ def self.cl_ssl_ca_file=(flag)
     @@cl_ssl_ca_file = flag
   end
 
+  # renders the apikey and endpoint options as a string for the helper commands
+  def self.cl_options_string
+    require 'shellwords'
+    
+    string = ""
+    string += "-k #{@@apikey} " if @@cl_apikey
+    string += "-e #{@@endpoint} " if @@cl_endpoint
+    string += "--import-endpoint #{@@import_endpoint} " if @@cl_import_endpoint
+    string += "--insecure " if @@cl_ssl_verify && !@@ssl_verify
+    string += "--ssl-ca-file #{Shellwords.escape(@@ssl_ca_file)} " if @@cl_ssl_ca_file
+    string
+  end
+
 end # class Config
 end # module TreasureData
diff --git a/spec/td/command/common_spec.rb b/spec/td/command/common_spec.rb
new file mode 100644
index 0000000..084dd0c
--- /dev/null
+++ b/spec/td/command/common_spec.rb
@@ -0,0 +1,37 @@
+require 'spec_helper'
+require 'td/command/common'
+require 'td/config'
+
+module TreasureData::Command
+  describe 'get_client' do
+    let(:command) { Object.new.extend(TreasureData::Command) }
+    
+    before do
+      allow(TreasureData::Config).to receive(:apikey).and_return('test_apikey')
+      allow(TreasureData::Config).to receive(:secure).and_return(true)
+      allow(TreasureData::Config).to receive(:retry_post_requests).and_return(false)
+      allow(TreasureData::Config).to receive(:endpoint).and_return(nil)
+      allow(TreasureData::Config).to receive(:ssl_verify).and_return(true)
+      allow(TreasureData::Config).to receive(:ssl_ca_file).and_return(nil)
+    end
+    
+    it 'passes ssl_verify=false to client when ssl_verify is false' do
+      allow(TreasureData::Config).to receive(:ssl_verify).and_return(false)
+      expect(TreasureData::Client).to receive(:new).with('test_apikey', hash_including(verify: false))
+      command.get_client
+    end
+    
+    it 'passes ssl_ca_file to client when ssl_ca_file is set' do
+      allow(TreasureData::Config).to receive(:ssl_ca_file).and_return('/path/to/ca.crt')
+      expect(TreasureData::Client).to receive(:new).with('test_apikey', hash_including(verify: '/path/to/ca.crt'))
+      command.get_client
+    end
+    
+    it 'does not set verify option when ssl_verify is true and ssl_ca_file is not set' do
+      allow(TreasureData::Config).to receive(:ssl_verify).and_return(true)
+      allow(TreasureData::Config).to receive(:ssl_ca_file).and_return(nil)
+      expect(TreasureData::Client).to receive(:new).with('test_apikey', hash_not_including(:verify))
+      command.get_client
+    end
+  end
+end
\ No newline at end of file
diff --git a/spec/td/ssl_options_spec.rb b/spec/td/ssl_options_spec.rb
new file mode 100644
index 0000000..0e23562
--- /dev/null
+++ b/spec/td/ssl_options_spec.rb
@@ -0,0 +1,98 @@
+require 'spec_helper'
+require 'tempfile'
+require 'td/config'
+
+describe TreasureData::Config do
+  describe 'SSL options' do
+    context 'ssl_verify' do
+      before do
+        TreasureData::Config.cl_ssl_verify = false
+        TreasureData::Config.ssl_verify = true
+        ENV.delete('TD_SSL_VERIFY')
+      end
+
+      it 'returns default value when not set' do
+        expect(TreasureData::Config.ssl_verify).to eq true
+      end
+
+      it 'returns value from command line when set' do
+        TreasureData::Config.cl_ssl_verify = true
+        TreasureData::Config.ssl_verify = false
+        expect(TreasureData::Config.ssl_verify).to eq false
+      end
+
+      it 'reads value from config file' do
+        Tempfile.create('td.conf') do |f|
+          f << <<-EOF
+[ssl]
+verify=false
+          EOF
+          f.close
+
+          allow(TreasureData::Config).to receive(:read).and_return(TreasureData::Config.new.read(f.path))
+          expect(TreasureData::Config.ssl_verify).to eq false
+        end
+      end
+    end
+
+    context 'ssl_ca_file' do
+      before do
+        TreasureData::Config.cl_ssl_ca_file = false
+        TreasureData::Config.ssl_ca_file = nil
+        ENV.delete('TD_SSL_CA_FILE')
+      end
+
+      it 'returns nil when not set' do
+        expect(TreasureData::Config.ssl_ca_file).to be_nil
+      end
+
+      it 'returns value from command line when set' do
+        TreasureData::Config.cl_ssl_ca_file = true
+        TreasureData::Config.ssl_ca_file = '/path/to/ca.crt'
+        expect(TreasureData::Config.ssl_ca_file).to eq '/path/to/ca.crt'
+      end
+
+      it 'reads value from config file' do
+        Tempfile.create('td.conf') do |f|
+          f << <<-EOF
+[ssl]
+ca_file=/path/to/ca.crt
+          EOF
+          f.close
+
+          allow(TreasureData::Config).to receive(:read).and_return(TreasureData::Config.new.read(f.path))
+          expect(TreasureData::Config.ssl_ca_file).to eq '/path/to/ca.crt'
+        end
+      end
+    end
+
+    context 'cl_options_string' do
+      before do
+        TreasureData::Config.cl_apikey = true
+        TreasureData::Config.apikey = 'test_apikey'
+        TreasureData::Config.cl_endpoint = false
+        TreasureData::Config.cl_import_endpoint = false
+        TreasureData::Config.cl_ssl_verify = false
+        TreasureData::Config.cl_ssl_ca_file = false
+      end
+
+      it 'includes insecure option when ssl_verify is false' do
+        TreasureData::Config.cl_ssl_verify = true
+        TreasureData::Config.ssl_verify = false
+        expect(TreasureData::Config.cl_options_string).to include('--insecure')
+      end
+
+      it 'includes ssl_ca_file option when set' do
+        TreasureData::Config.cl_ssl_ca_file = true
+        TreasureData::Config.ssl_ca_file = '/path/to/ca.crt'
+        expect(TreasureData::Config.cl_options_string).to include('--ssl-ca-file /path/to/ca.crt')
+      end
+
+      it 'escapes ssl_ca_file path with spaces' do
+        TreasureData::Config.cl_ssl_ca_file = true
+        TreasureData::Config.ssl_ca_file = '/path/to/my ca.crt'
+        expect(TreasureData::Config.cl_options_string).to include('--ssl-ca-file /path/to/my\\ ca.crt')
+      end
+    end
+  end
+end
\ No newline at end of file

From a4bb9cc3d27c5a0e5899543763496980edb8a76f Mon Sep 17 00:00:00 2001
From: Mikio Tachibana <m.tachibana25@gmail.com>
Date: Tue, 3 Jun 2025 22:17:35 +0900
Subject: [PATCH 3/7] Refactor SSL handling in import and runner commands;
 remove deprecated tests

---
 lib/td/command/import.rb            | 12 ++-----
 lib/td/command/runner.rb            |  1 -
 spec/td/command/common_spec.rb      | 37 ---------------------
 spec/td/command/ssl_options_spec.rb | 50 +++++++++++++----------------
 4 files changed, 25 insertions(+), 75 deletions(-)
 delete mode 100644 spec/td/command/common_spec.rb

diff --git a/lib/td/command/import.rb b/lib/td/command/import.rb
index eb03486..7191e78 100644
--- a/lib/td/command/import.rb
+++ b/lib/td/command/import.rb
@@ -306,15 +306,9 @@ def set_sysprops_endpoint(sysprops)
 
         # generic URI
         host, port = endpoint.split(':', 2)
-        port = port.to_i
-        # Config.secure = false is the --insecure option was used
-        if Config.secure
-          port = 443 if port == 0
-          ssl = true
-        else
-          port = 80 if port == 0
-          ssl = false
-        end
+        port = port.to_i == 0 ? 443 : port.to_i
+        ssl = true
+
       end
 
       sysprops << "-Dtd.api.server.scheme=#{ssl ? 'https' : 'http'}://"
diff --git a/lib/td/command/runner.rb b/lib/td/command/runner.rb
index 4d732a6..fee8fa9 100644
--- a/lib/td/command/runner.rb
+++ b/lib/td/command/runner.rb
@@ -164,7 +164,6 @@ def run(argv=ARGV)
         Config.cl_import_endpoint = true
       end
       if insecure
-        Config.secure = false
         Config.ssl_verify = false
         Config.cl_ssl_verify = true
         $stderr.puts "Warning: --insecure option disables SSL certificate verification, which is not recommended for production use."
diff --git a/spec/td/command/common_spec.rb b/spec/td/command/common_spec.rb
deleted file mode 100644
index 084dd0c..0000000
--- a/spec/td/command/common_spec.rb
+++ /dev/null
@@ -1,37 +0,0 @@
-require 'spec_helper'
-require 'td/command/common'
-require 'td/config'
-
-module TreasureData::Command
-  describe 'get_client' do
-    let(:command) { Object.new.extend(TreasureData::Command) }
-    
-    before do
-      allow(TreasureData::Config).to receive(:apikey).and_return('test_apikey')
-      allow(TreasureData::Config).to receive(:secure).and_return(true)
-      allow(TreasureData::Config).to receive(:retry_post_requests).and_return(false)
-      allow(TreasureData::Config).to receive(:endpoint).and_return(nil)
-      allow(TreasureData::Config).to receive(:ssl_verify).and_return(true)
-      allow(TreasureData::Config).to receive(:ssl_ca_file).and_return(nil)
-    end
-    
-    it 'passes ssl_verify=false to client when ssl_verify is false' do
-      allow(TreasureData::Config).to receive(:ssl_verify).and_return(false)
-      expect(TreasureData::Client).to receive(:new).with('test_apikey', hash_including(verify: false))
-      command.get_client
-    end
-    
-    it 'passes ssl_ca_file to client when ssl_ca_file is set' do
-      allow(TreasureData::Config).to receive(:ssl_ca_file).and_return('/path/to/ca.crt')
-      expect(TreasureData::Client).to receive(:new).with('test_apikey', hash_including(verify: '/path/to/ca.crt'))
-      command.get_client
-    end
-    
-    it 'does not set verify option when ssl_verify is true and ssl_ca_file is not set' do
-      allow(TreasureData::Config).to receive(:ssl_verify).and_return(true)
-      allow(TreasureData::Config).to receive(:ssl_ca_file).and_return(nil)
-      expect(TreasureData::Client).to receive(:new).with('test_apikey', hash_not_including(:verify))
-      command.get_client
-    end
-  end
-end
\ No newline at end of file
diff --git a/spec/td/command/ssl_options_spec.rb b/spec/td/command/ssl_options_spec.rb
index 15853be..435f44f 100644
--- a/spec/td/command/ssl_options_spec.rb
+++ b/spec/td/command/ssl_options_spec.rb
@@ -7,9 +7,8 @@
 module TreasureData
   module Command
     describe 'SSL Options' do
-      include_context 'common helper'
 
-      let(:command) { Object.new.extend(Command) }
+      let(:command) { Class.new { include TreasureData::Command }.new }
       let(:config_path) { Tempfile.new('td-config').path }
       let(:runner) { TreasureData::Command::Runner.new }
 
@@ -58,64 +57,59 @@ module Command
           expect(Config.ssl_ca_file).to eq '/path/to/ca.crt'
         end
 
+        
         it 'respects priority order: CLI > env > config' do
-          # Set config file
+          Config.cl_ssl_verify = false
+          Config.cl_ssl_ca_file = false
+        
           File.open(config_path, 'w') do |f|
             f.puts "[ssl]"
             f.puts "verify = false"
             f.puts "ca_file = /path/from/config.crt"
           end
 
-          # Set environment variables
+          expect(Config.ssl_verify).to be false
+          expect(Config.ssl_ca_file).to eq '/path/from/config.crt'
+
           ENV['TD_SSL_VERIFY'] = 'true'
           ENV['TD_SSL_CA_FILE'] = '/path/from/env.crt'
-
-          # Environment should override config
-          Config.cl_ssl_verify = false
-          Config.cl_ssl_ca_file = false
-          expect(Config.ssl_verify).to be true
-          expect(Config.ssl_ca_file).to eq '/path/from/env.crt'
-
-          # CLI should override environment
+        
+        
           ca_file = Tempfile.new('ca-cert').path
           File.write(ca_file, "dummy cert")
-          
+        
           runner.run(['--ssl-ca-file', ca_file, '--insecure', 'status'])
           expect(Config.ssl_verify).to be false
           expect(Config.ssl_ca_file).to eq ca_file
-          
+        
           File.unlink(ca_file)
-          
-          # Reset environment variables
+        
           ENV.delete('TD_SSL_VERIFY')
           ENV.delete('TD_SSL_CA_FILE')
         end
-      end
 
       describe 'Client creation with SSL options' do
         it 'passes verify=false to client when --insecure is used' do
           runner.run(['--insecure', 'status'])
-          
-          client_opts = {}
           expect(TreasureData::Client).to receive(:new).with("dummy", hash_including(verify: false)).and_return(double('client').as_null_object)
           
           command.send(:get_client)
         end
 
-        it 'passes verify=ca_file to client when --ssl-ca-file is used' do
-          ca_file = Tempfile.new('ca-cert').path
-          File.write(ca_file, "dummy cert")
+          it 'passes verify=ca_file to client when --ssl-ca-file is used' do
+            ca_file = Tempfile.new('ca-cert').path
+            File.write(ca_file, "dummy cert")
           
-          runner.run(['--ssl-ca-file', ca_file, 'status'])
+            runner.run(['--ssl-ca-file', ca_file, 'status'])
           
-          client_opts = {}
-          expect(TreasureData::Client).to receive(:new).with("dummy", hash_including(verify: ca_file)).and_return(double('client').as_null_object)
+            expect(TreasureData::Client).to receive(:new).with("dummy", hash_including(verify: ca_file)).and_return(double('client').as_null_object)
           
-          command.send(:get_client)
+            command.send(:get_client)
           
-          File.unlink(ca_file)
+            File.unlink(ca_file)
+          end
         end
       end
     end
   end
-end
\ No newline at end of file
+end

From a2290ec4098eda3390e613dabe4903aa9f997344 Mon Sep 17 00:00:00 2001
From: Mikio Tachibana <m.tachibana25@gmail.com>
Date: Tue, 3 Jun 2025 22:18:20 +0900
Subject: [PATCH 4/7] add newline

---
 spec/td/ssl_options_spec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec/td/ssl_options_spec.rb b/spec/td/ssl_options_spec.rb
index 0e23562..6ec697f 100644
--- a/spec/td/ssl_options_spec.rb
+++ b/spec/td/ssl_options_spec.rb
@@ -95,4 +95,4 @@
       end
     end
   end
-end
\ No newline at end of file
+end

From c63600ff725a2fcb7a998d035cde043766a5b1fc Mon Sep 17 00:00:00 2001
From: Mikio Tachibana <m.tachibana25@gmail.com>
Date: Tue, 10 Jun 2025 21:08:16 +0900
Subject: [PATCH 5/7] update test

---
 spec/td/command/ssl_options_spec.rb | 306 +++++++++++++++++++++++-----
 spec/td/ssl_options_spec.rb         | 234 +++++++++++++++++----
 2 files changed, 451 insertions(+), 89 deletions(-)

diff --git a/spec/td/command/ssl_options_spec.rb b/spec/td/command/ssl_options_spec.rb
index 435f44f..ad095c2 100644
--- a/spec/td/command/ssl_options_spec.rb
+++ b/spec/td/command/ssl_options_spec.rb
@@ -3,18 +3,32 @@
 require 'td/command/common'
 require 'td/command/runner'
 require 'tempfile'
+require 'stringio'
 
 module TreasureData
   module Command
     describe 'SSL Options' do
+      include_context 'quiet_out'
 
       let(:command) { Class.new { include TreasureData::Command }.new }
       let(:config_path) { Tempfile.new('td-config').path }
       let(:runner) { TreasureData::Command::Runner.new }
+      let(:ca_file_content) { "-----BEGIN CERTIFICATE-----\nMIIDummy\n-----END CERTIFICATE-----" }
 
       before do
+        # Save original environment state
+        @original_env = {
+          'TD_SSL_VERIFY' => ENV['TD_SSL_VERIFY'],
+          'TD_SSL_CA_FILE' => ENV['TD_SSL_CA_FILE']
+        }
+        
+        # Clean environment
+        ENV.delete('TD_SSL_VERIFY')
+        ENV.delete('TD_SSL_CA_FILE')
+        
+        # Reset config state
         Config.path = config_path
-        Config.apikey = "dummy"
+        Config.apikey = "dummy_api_key"
         Config.cl_apikey = true
         Config.ssl_verify = true
         Config.ssl_ca_file = nil
@@ -23,90 +37,284 @@ module Command
       end
 
       after do
+        # Restore original environment
+        @original_env.each do |key, value|
+          if value
+            ENV[key] = value
+          else
+            ENV.delete(key)
+          end
+        end
+        
+        # Clean up temp files
         File.unlink(config_path) if File.exist?(config_path)
       end
 
-      describe 'SSL verification options' do
-        it 'disables verification with --insecure' do
-          runner.run(['--insecure', 'status'])
+      describe 'CLI option parsing' do
+        it 'sets ssl_verify to false with --insecure flag' do
+          # Use help command to avoid actual TD API calls
+          expect { runner.run(['--insecure', 'help']) }.to raise_error(SystemExit)
           expect(Config.ssl_verify).to be false
+          expect(Config.cl_ssl_verify).to be true
         end
 
-        it 'sets custom CA file with --ssl-ca-file' do
-          ca_file = Tempfile.new('ca-cert').path
-          File.write(ca_file, "dummy cert")
-          
-          runner.run(['--ssl-ca-file', ca_file, 'status'])
-          expect(Config.ssl_ca_file).to eq ca_file
-          
-          File.unlink(ca_file)
+        it 'sets CA file path with valid --ssl-ca-file' do
+          Tempfile.create('ca-cert') do |ca_file|
+            ca_file.write(ca_file_content)
+            ca_file.close
+            
+            expect { runner.run(['--ssl-ca-file', ca_file.path, 'help']) }.to raise_error(SystemExit)
+            expect(Config.ssl_ca_file).to eq ca_file.path
+            expect(Config.cl_ssl_ca_file).to be true
+          end
+        end
+
+        it 'displays warning when using --insecure' do
+          expect { runner.run(['--insecure', 'help']) }.to raise_error(SystemExit)
+          expect(stderr_io.string).to include('Warning: --insecure option disables SSL certificate verification')
         end
+      end
 
-        it 'reads SSL options from config file' do
+      describe 'Configuration file reading' do
+        it 'reads ssl.verify from config file' do
           File.open(config_path, 'w') do |f|
             f.puts "[ssl]"
             f.puts "verify = false"
-            f.puts "ca_file = /path/to/ca.crt"
           end
-
-          # Reset flags to ensure we read from config
+          
+          # Ensure CLI flags are not set
           Config.cl_ssl_verify = false
-          Config.cl_ssl_ca_file = false
           
           expect(Config.ssl_verify).to be false
-          expect(Config.ssl_ca_file).to eq '/path/to/ca.crt'
         end
 
-        
-        it 'respects priority order: CLI > env > config' do
-          Config.cl_ssl_verify = false
+        it 'reads ssl.ca_file from config file' do
+          ca_file_path = '/path/to/test/ca.crt'
+          File.open(config_path, 'w') do |f|
+            f.puts "[ssl]"
+            f.puts "ca_file = #{ca_file_path}"
+          end
+          
+          # Ensure CLI flags are not set
           Config.cl_ssl_ca_file = false
+          
+          expect(Config.ssl_ca_file).to eq ca_file_path
+        end
+
+        it 'handles ssl.verify = true in config file' do
+          File.open(config_path, 'w') do |f|
+            f.puts "[ssl]"
+            f.puts "verify = true"
+          end
+          
+          Config.cl_ssl_verify = false
+          expect(Config.ssl_verify).to be true
+        end
         
+        it 'treats non-false values as true for ssl.verify' do
           File.open(config_path, 'w') do |f|
             f.puts "[ssl]"
-            f.puts "verify = false"
-            f.puts "ca_file = /path/from/config.crt"
+            f.puts "verify = anything"
           end
+          
+          Config.cl_ssl_verify = false
+          expect(Config.ssl_verify).to be true
+        end
+      end
 
-          expect(Config.ssl_verify).to be false
-          expect(Config.ssl_ca_file).to eq '/path/from/config.crt'
+      describe 'Environment variable support' do
+        it 'respects TD_SSL_VERIFY=false from environment' do
+          # Test the environment variable initialization logic directly
+          ENV['TD_SSL_VERIFY'] = 'false'
+          ssl_verify_from_env = ENV['TD_SSL_VERIFY'].nil? ? true : (ENV['TD_SSL_VERIFY'].downcase == 'false' ? false : true)
+          expect(ssl_verify_from_env).to be false
+        end
 
+        it 'respects TD_SSL_VERIFY=true from environment' do
           ENV['TD_SSL_VERIFY'] = 'true'
-          ENV['TD_SSL_CA_FILE'] = '/path/from/env.crt'
-        
-        
-          ca_file = Tempfile.new('ca-cert').path
-          File.write(ca_file, "dummy cert")
-        
-          runner.run(['--ssl-ca-file', ca_file, '--insecure', 'status'])
+          ssl_verify_from_env = ENV['TD_SSL_VERIFY'].nil? ? true : (ENV['TD_SSL_VERIFY'].downcase == 'false' ? false : true)
+          expect(ssl_verify_from_env).to be true
+        end
+
+        it 'respects TD_SSL_CA_FILE from environment' do
+          ca_file_path = '/env/path/to/ca.crt'
+          ENV['TD_SSL_CA_FILE'] = ca_file_path
+          ssl_ca_file_from_env = ENV['TD_SSL_CA_FILE']
+          ssl_ca_file_from_env = nil if ssl_ca_file_from_env == ""
+          expect(ssl_ca_file_from_env).to eq ca_file_path
+        end
+
+        it 'handles empty TD_SSL_CA_FILE' do
+          ENV['TD_SSL_CA_FILE'] = ''
+          ssl_ca_file_from_env = ENV['TD_SSL_CA_FILE']
+          ssl_ca_file_from_env = nil if ssl_ca_file_from_env == ""
+          expect(ssl_ca_file_from_env).to be_nil
+        end
+      end
+
+      describe 'Priority order: CLI > env > config > default' do
+        it 'CLI options override environment variables' do
+          # Set environment
+          ENV['TD_SSL_VERIFY'] = 'true'
+          ENV['TD_SSL_CA_FILE'] = '/env/ca.crt'
+          
+          Tempfile.create('cli-ca-cert') do |ca_file|
+            ca_file.write(ca_file_content)
+            ca_file.close
+            
+            # CLI should win
+            expect { runner.run(['--insecure', '--ssl-ca-file', ca_file.path, 'help']) }.to raise_error(SystemExit)
+            
+            expect(Config.ssl_verify).to be false
+            expect(Config.ssl_ca_file).to eq ca_file.path
+          end
+        end
+
+        it 'Config file overrides defaults' do
+          File.open(config_path, 'w') do |f|
+            f.puts "[ssl]"
+            f.puts "verify = false"
+            f.puts "ca_file = /config/ca.crt"
+          end
+          
+          # Ensure no CLI or env overrides
+          Config.cl_ssl_verify = false
+          Config.cl_ssl_ca_file = false
+          
           expect(Config.ssl_verify).to be false
-          expect(Config.ssl_ca_file).to eq ca_file
-        
-          File.unlink(ca_file)
-        
-          ENV.delete('TD_SSL_VERIFY')
-          ENV.delete('TD_SSL_CA_FILE')
+          expect(Config.ssl_ca_file).to eq '/config/ca.crt'
+        end
+      end
+
+      describe 'Client integration' do
+        before do
+          # Mock TreasureData::Client to avoid actual network calls
+          allow(TreasureData::Client).to receive(:new).and_return(double('client').as_null_object)
         end
 
-      describe 'Client creation with SSL options' do
-        it 'passes verify=false to client when --insecure is used' do
-          runner.run(['--insecure', 'status'])
-          expect(TreasureData::Client).to receive(:new).with("dummy", hash_including(verify: false)).and_return(double('client').as_null_object)
+        it 'passes verify: false to client when ssl_verify is disabled' do
+          Config.ssl_verify = false
+          Config.cl_ssl_verify = true
           
+          expect(TreasureData::Client).to receive(:new).with("dummy_api_key", hash_including(verify: false))
           command.send(:get_client)
         end
 
-          it 'passes verify=ca_file to client when --ssl-ca-file is used' do
-            ca_file = Tempfile.new('ca-cert').path
-            File.write(ca_file, "dummy cert")
+        it 'passes verify: ca_file_path to client when ssl_ca_file is set' do
+          ca_file_path = '/path/to/ca.crt'
+          Config.ssl_ca_file = ca_file_path
+          Config.cl_ssl_ca_file = true
+          
+          expect(TreasureData::Client).to receive(:new).with("dummy_api_key", hash_including(verify: ca_file_path))
+          command.send(:get_client)
+        end
+
+        it 'does not pass SSL options when using defaults' do
+          # Default config
+          Config.ssl_verify = true
+          Config.ssl_ca_file = nil
+          Config.cl_ssl_verify = false
+          Config.cl_ssl_ca_file = false
+          
+          expect(TreasureData::Client).to receive(:new).with("dummy_api_key", hash_not_including(:verify))
+          command.send(:get_client)
+        end
+      end
+
+      describe 'cl_options_string generation' do
+        before do
+          Config.cl_apikey = true
+          Config.apikey = 'test_key'
+          Config.cl_endpoint = false
+          Config.cl_import_endpoint = false
+        end
+
+        it 'includes --insecure when ssl_verify is false via CLI' do
+          Config.cl_ssl_verify = true
+          Config.ssl_verify = false
           
-            runner.run(['--ssl-ca-file', ca_file, 'status'])
+          expect(Config.cl_options_string).to include('--insecure')
+        end
+
+        it 'includes --ssl-ca-file when set via CLI' do
+          Config.cl_ssl_ca_file = true
+          Config.ssl_ca_file = '/path/to/ca.crt'
           
-            expect(TreasureData::Client).to receive(:new).with("dummy", hash_including(verify: ca_file)).and_return(double('client').as_null_object)
+          expect(Config.cl_options_string).to include('--ssl-ca-file /path/to/ca.crt')
+        end
+
+        it 'properly escapes CA file paths with spaces' do
+          Config.cl_ssl_ca_file = true
+          Config.ssl_ca_file = '/path/with spaces/ca.crt'
           
-            command.send(:get_client)
+          expect(Config.cl_options_string).to include('--ssl-ca-file /path/with\\ spaces/ca.crt')
+        end
+
+        it 'does not include SSL options when not set via CLI' do
+          Config.cl_ssl_verify = false
+          Config.cl_ssl_ca_file = false
           
-            File.unlink(ca_file)
+          options_string = Config.cl_options_string
+          expect(options_string).not_to include('--insecure')
+          expect(options_string).not_to include('--ssl-ca-file')
+        end
+      end
+
+      describe 'SSL option validation in runner' do
+        it 'validates that SSL CA file validation occurs in runner.rb' do
+          # Check that the runner code contains the validation logic
+          runner_file = File.read(File.join(File.dirname(__FILE__), '..', '..', '..', 'lib', 'td', 'command', 'runner.rb'))
+          expect(runner_file).to include('unless File.exist?(s)')
+          expect(runner_file).to include('ParameterConfigurationError')
+          expect(runner_file).to include('CA certification file not found')
+        end
+
+        it 'validates that warning is shown for --insecure' do
+          runner_file = File.read(File.join(File.dirname(__FILE__), '..', '..', '..', 'lib', 'td', 'command', 'runner.rb'))
+          expect(runner_file).to include('Warning: --insecure option disables SSL certificate verification')
+        end
+      end
+
+      describe 'Integration testing with execute_td helper' do
+        it 'shows SSL options in help' do
+          _, stdout = execute_td('--help')
+          expect(stdout).to include('--insecure')
+          expect(stdout).to include('--ssl-ca-file')
+        end
+
+        it 'validates SSL warning message appears' do
+          stderr, _ = execute_td('--insecure help')
+          expect(stderr).to include('Warning:')
+          expect(stderr).to include('insecure')
+        end
+      end
+
+      describe 'SSL configuration integration' do
+        it 'initializes SSL config properly from environment variables' do
+          original_env = {
+            'TD_SSL_VERIFY' => ENV['TD_SSL_VERIFY'],
+            'TD_SSL_CA_FILE' => ENV['TD_SSL_CA_FILE']
+          }
+
+          begin
+            ENV['TD_SSL_VERIFY'] = 'false'
+            ENV['TD_SSL_CA_FILE'] = '/test/ca.crt'
+
+            # Load a fresh Config class to test environment initialization
+            load File.join(File.dirname(__FILE__), '..', '..', '..', 'lib', 'td', 'config.rb')
+
+            # The config should read environment variables at load time
+            expect(ENV['TD_SSL_VERIFY']).to eq 'false'
+            expect(ENV['TD_SSL_CA_FILE']).to eq '/test/ca.crt'
+          ensure
+            # Restore environment
+            original_env.each do |key, value|
+              if value
+                ENV[key] = value
+              else
+                ENV.delete(key)
+              end
+            end
           end
         end
       end
diff --git a/spec/td/ssl_options_spec.rb b/spec/td/ssl_options_spec.rb
index 6ec697f..bd7078d 100644
--- a/spec/td/ssl_options_spec.rb
+++ b/spec/td/ssl_options_spec.rb
@@ -4,65 +4,135 @@
 
 describe TreasureData::Config do
   describe 'SSL options' do
-    context 'ssl_verify' do
-      before do
-        TreasureData::Config.cl_ssl_verify = false
-        TreasureData::Config.ssl_verify = true
-        ENV.delete('TD_SSL_VERIFY')
+    let(:config_file) { Tempfile.new('td-config') }
+    let(:config_path) { config_file.path }
+    
+    before do
+      # Save original environment state
+      @original_env = {
+        'TD_SSL_VERIFY' => ENV['TD_SSL_VERIFY'],
+        'TD_SSL_CA_FILE' => ENV['TD_SSL_CA_FILE']
+      }
+      
+      # Clean environment
+      ENV.delete('TD_SSL_VERIFY')
+      ENV.delete('TD_SSL_CA_FILE')
+      
+      # Reset config state
+      TreasureData::Config.cl_ssl_verify = false
+      TreasureData::Config.ssl_verify = true
+      TreasureData::Config.cl_ssl_ca_file = false
+      TreasureData::Config.ssl_ca_file = nil
+    end
+
+    after do
+      # Restore original environment
+      @original_env.each do |key, value|
+        if value
+          ENV[key] = value
+        else
+          ENV.delete(key)
+        end
       end
+      
+      # Clean up
+      config_file.close
+      config_file.unlink
+    end
 
-      it 'returns default value when not set' do
+    context 'ssl_verify' do
+      it 'returns default value (true) when not configured' do
         expect(TreasureData::Config.ssl_verify).to eq true
       end
 
-      it 'returns value from command line when set' do
+      it 'returns value from command line when cl_ssl_verify is true' do
         TreasureData::Config.cl_ssl_verify = true
         TreasureData::Config.ssl_verify = false
         expect(TreasureData::Config.ssl_verify).to eq false
       end
 
-      it 'reads value from config file' do
-        Tempfile.create('td.conf') do |f|
-          f << <<-EOF
+      it 'reads false value from config file' do
+        config_file.write <<-EOF
 [ssl]
-verify=false
-          EOF
-          f.close
+verify = false
+        EOF
+        config_file.close
 
-          allow(TreasureData::Config).to receive(:read).and_return(TreasureData::Config.new.read(f.path))
-          expect(TreasureData::Config.ssl_verify).to eq false
-        end
+        allow(TreasureData::Config).to receive(:read).and_return(TreasureData::Config.new.read(config_path))
+        expect(TreasureData::Config.ssl_verify).to eq false
       end
-    end
 
-    context 'ssl_ca_file' do
-      before do
-        TreasureData::Config.cl_ssl_ca_file = false
-        TreasureData::Config.ssl_ca_file = nil
-        ENV.delete('TD_SSL_CA_FILE')
+      it 'reads true value from config file' do
+        config_file.write <<-EOF
+[ssl]
+verify = true
+        EOF
+        config_file.close
+
+        allow(TreasureData::Config).to receive(:read).and_return(TreasureData::Config.new.read(config_path))
+        expect(TreasureData::Config.ssl_verify).to eq true
+      end
+
+      it 'treats non-false values as true in config file' do
+        config_file.write <<-EOF
+[ssl]
+verify = anything_else
+        EOF
+        config_file.close
+
+        allow(TreasureData::Config).to receive(:read).and_return(TreasureData::Config.new.read(config_path))
+        expect(TreasureData::Config.ssl_verify).to eq true
+      end
+
+      it 'respects environment variable TD_SSL_VERIFY=false' do
+        ENV['TD_SSL_VERIFY'] = 'false'
+        # Simulate config initialization with env var
+        TreasureData::Config.ssl_verify = (ENV['TD_SSL_VERIFY'].downcase == 'false' ? false : true)
+        expect(TreasureData::Config.ssl_verify).to eq false
       end
 
-      it 'returns nil when not set' do
+      it 'respects environment variable TD_SSL_VERIFY=true' do
+        ENV['TD_SSL_VERIFY'] = 'true'
+        # Simulate config initialization with env var
+        TreasureData::Config.ssl_verify = (ENV['TD_SSL_VERIFY'].downcase == 'false' ? false : true)
+        expect(TreasureData::Config.ssl_verify).to eq true
+      end
+    end
+
+    context 'ssl_ca_file' do
+      it 'returns nil when not configured' do
         expect(TreasureData::Config.ssl_ca_file).to be_nil
       end
 
-      it 'returns value from command line when set' do
+      it 'returns value from command line when cl_ssl_ca_file is true' do
         TreasureData::Config.cl_ssl_ca_file = true
-        TreasureData::Config.ssl_ca_file = '/path/to/ca.crt'
-        expect(TreasureData::Config.ssl_ca_file).to eq '/path/to/ca.crt'
+        TreasureData::Config.ssl_ca_file = '/cli/path/to/ca.crt'
+        expect(TreasureData::Config.ssl_ca_file).to eq '/cli/path/to/ca.crt'
       end
 
       it 'reads value from config file' do
-        Tempfile.create('td.conf') do |f|
-          f << <<-EOF
+        config_file.write <<-EOF
 [ssl]
-ca_file=/path/to/ca.crt
-          EOF
-          f.close
+ca_file = /config/path/to/ca.crt
+        EOF
+        config_file.close
 
-          allow(TreasureData::Config).to receive(:read).and_return(TreasureData::Config.new.read(f.path))
-          expect(TreasureData::Config.ssl_ca_file).to eq '/path/to/ca.crt'
-        end
+        allow(TreasureData::Config).to receive(:read).and_return(TreasureData::Config.new.read(config_path))
+        expect(TreasureData::Config.ssl_ca_file).to eq '/config/path/to/ca.crt'
+      end
+
+      it 'respects environment variable TD_SSL_CA_FILE' do
+        ENV['TD_SSL_CA_FILE'] = '/env/path/to/ca.crt'
+        # Simulate config initialization with env var
+        TreasureData::Config.ssl_ca_file = ENV['TD_SSL_CA_FILE']
+        expect(TreasureData::Config.ssl_ca_file).to eq '/env/path/to/ca.crt'
+      end
+
+      it 'handles empty TD_SSL_CA_FILE environment variable' do
+        ENV['TD_SSL_CA_FILE'] = ''
+        # Simulate config initialization with empty env var
+        TreasureData::Config.ssl_ca_file = ENV['TD_SSL_CA_FILE'] == '' ? nil : ENV['TD_SSL_CA_FILE']
+        expect(TreasureData::Config.ssl_ca_file).to be_nil
       end
     end
 
@@ -76,23 +146,107 @@
         TreasureData::Config.cl_ssl_ca_file = false
       end
 
-      it 'includes insecure option when ssl_verify is false' do
+      it 'includes API key when cl_apikey is true' do
+        expect(TreasureData::Config.cl_options_string).to include('-k test_apikey')
+      end
+
+      it 'includes --insecure when cl_ssl_verify is true and ssl_verify is false' do
         TreasureData::Config.cl_ssl_verify = true
         TreasureData::Config.ssl_verify = false
         expect(TreasureData::Config.cl_options_string).to include('--insecure')
       end
 
-      it 'includes ssl_ca_file option when set' do
+      it 'does not include --insecure when cl_ssl_verify is false' do
+        TreasureData::Config.cl_ssl_verify = false
+        expect(TreasureData::Config.cl_options_string).not_to include('--insecure')
+      end
+
+      it 'includes --ssl-ca-file when cl_ssl_ca_file is true' do
         TreasureData::Config.cl_ssl_ca_file = true
         TreasureData::Config.ssl_ca_file = '/path/to/ca.crt'
         expect(TreasureData::Config.cl_options_string).to include('--ssl-ca-file /path/to/ca.crt')
       end
 
-      it 'escapes ssl_ca_file path with spaces' do
+      it 'does not include --ssl-ca-file when cl_ssl_ca_file is false' do
+        TreasureData::Config.cl_ssl_ca_file = false
+        expect(TreasureData::Config.cl_options_string).not_to include('--ssl-ca-file')
+      end
+
+      it 'properly escapes CA file paths with spaces' do
+        TreasureData::Config.cl_ssl_ca_file = true
+        TreasureData::Config.ssl_ca_file = '/path/with spaces/ca.crt'
+        expect(TreasureData::Config.cl_options_string).to include('--ssl-ca-file /path/with\\ spaces/ca.crt')
+      end
+
+      it 'properly escapes CA file paths with special characters' do
+        TreasureData::Config.cl_ssl_ca_file = true
+        TreasureData::Config.ssl_ca_file = '/path/with$special&chars/ca.crt'
+        expect(TreasureData::Config.cl_options_string).to include('--ssl-ca-file /path/with\\$special\\&chars/ca.crt')
+      end
+    end
+
+    context 'Configuration priority' do
+      it 'CLI options have highest priority' do
+        # Set config file
+        config_file.write <<-EOF
+[ssl]
+verify = true
+ca_file = /config/ca.crt
+        EOF
+        config_file.close
+
+        # Set env vars
+        ENV['TD_SSL_VERIFY'] = 'true'
+        ENV['TD_SSL_CA_FILE'] = '/env/ca.crt'
+
+        # Set CLI options (should win)
+        TreasureData::Config.cl_ssl_verify = true
+        TreasureData::Config.ssl_verify = false
+        TreasureData::Config.cl_ssl_ca_file = true
+        TreasureData::Config.ssl_ca_file = '/cli/ca.crt'
+
+        expect(TreasureData::Config.ssl_verify).to eq false
+        expect(TreasureData::Config.ssl_ca_file).to eq '/cli/ca.crt'
+      end
+
+      it 'Environment variables override config file when CLI not set' do
+        # Set config file
+        config_file.write <<-EOF
+[ssl]
+verify = true
+ca_file = /config/ca.crt
+        EOF
+        config_file.close
+
+        # Set env vars (should win over config)
+        ENV['TD_SSL_VERIFY'] = 'false'
+        ENV['TD_SSL_CA_FILE'] = '/env/ca.crt'
+
+        # Simulate config initialization
+        TreasureData::Config.ssl_verify = (ENV['TD_SSL_VERIFY'].downcase == 'false' ? false : true)
+        TreasureData::Config.ssl_ca_file = ENV['TD_SSL_CA_FILE']
+        TreasureData::Config.cl_ssl_verify = false
+        TreasureData::Config.cl_ssl_ca_file = false
+
+        expect(TreasureData::Config.ssl_verify).to eq false
+        expect(TreasureData::Config.ssl_ca_file).to eq '/env/ca.crt'
+      end
+    end
+
+    context 'Flag management' do
+      it 'tracks cl_ssl_verify flag correctly' do
+        expect(TreasureData::Config.cl_ssl_verify).to eq false
+        
+        TreasureData::Config.cl_ssl_verify = true
+        expect(TreasureData::Config.cl_ssl_verify).to eq true
+      end
+
+      it 'tracks cl_ssl_ca_file flag correctly' do
+        expect(TreasureData::Config.cl_ssl_ca_file).to eq false
+        
         TreasureData::Config.cl_ssl_ca_file = true
-        TreasureData::Config.ssl_ca_file = '/path/to/my ca.crt'
-        expect(TreasureData::Config.cl_options_string).to include('--ssl-ca-file /path/to/my\\ ca.crt')
+        expect(TreasureData::Config.cl_ssl_ca_file).to eq true
       end
     end
   end
-end
+end
\ No newline at end of file

From 6ffb439e215bf0f6f9e5830e3dce686c6a7e5087 Mon Sep 17 00:00:00 2001
From: Mikio Tachibana <m.tachibana25@gmail.com>
Date: Fri, 20 Jun 2025 18:43:37 +0900
Subject: [PATCH 6/7] update files to use one options

---
 lib/td/command/runner.rb    | 16 ++++++++--------
 lib/td/config.rb            | 10 ++++++++--
 spec/td/ssl_options_spec.rb | 20 ++++++++++----------
 3 files changed, 26 insertions(+), 20 deletions(-)

diff --git a/lib/td/command/runner.rb b/lib/td/command/runner.rb
index fee8fa9..eac6b8f 100644
--- a/lib/td/command/runner.rb
+++ b/lib/td/command/runner.rb
@@ -105,16 +105,16 @@ def run(argv=ARGV)
       import_endpoint = e
     }
 
-    op.on('--insecure', "Insecure access: disable SSL certificate verification (enabled by default)") {|b|
-      insecure = true
-    }
-
-    op.on('--ssl-ca-file PATH', "Path to the CA certification file for SSL") {|s|
+    op.on('--ssl-verify VALUE', "SSL verification: 'false' to disable, or path to CA certificate file (default: true)") {|s|
       require 'td/command/common'
-      unless File.exist?(s)
-        raise ParameterConfigurationError, "CA certification file not found: #{s}"
+      if s.downcase == 'false'
+        insecure = true
+      else
+        unless File.exist?(s)
+          raise ParameterConfigurationError, "CA certification file not found: #{s}"
+        end
+        ssl_ca_file = s
       end
-      ssl_ca_file = s
     }
 
     op.on('-v', '--verbose', "verbose mode", TrueClass) {|b|
diff --git a/lib/td/config.rb b/lib/td/config.rb
index 5e44b94..e5e0aa2 100644
--- a/lib/td/config.rb
+++ b/lib/td/config.rb
@@ -263,8 +263,14 @@ def self.cl_options_string
     string += "-k #{@@apikey} " if @@cl_apikey
     string += "-e #{@@endpoint} " if @@cl_endpoint
     string += "--import-endpoint #{@@import_endpoint} " if @@cl_import_endpoint
-    string += "--insecure " if @@cl_ssl_verify && !@@ssl_verify
-    string += "--ssl-ca-file #{Shellwords.escape(@@ssl_ca_file)} " if @@cl_ssl_ca_file
+    
+    # Handle simplified SSL option
+    if @@cl_ssl_verify && !@@ssl_verify
+      string += "--ssl-verify false "
+    elsif @@cl_ssl_ca_file && @@ssl_ca_file
+      string += "--ssl-verify #{Shellwords.escape(@@ssl_ca_file)} "
+    end
+    
     string
   end
 
diff --git a/spec/td/ssl_options_spec.rb b/spec/td/ssl_options_spec.rb
index bd7078d..ccd0d57 100644
--- a/spec/td/ssl_options_spec.rb
+++ b/spec/td/ssl_options_spec.rb
@@ -150,38 +150,38 @@
         expect(TreasureData::Config.cl_options_string).to include('-k test_apikey')
       end
 
-      it 'includes --insecure when cl_ssl_verify is true and ssl_verify is false' do
+      it 'includes --ssl-verify false when cl_ssl_verify is true and ssl_verify is false' do
         TreasureData::Config.cl_ssl_verify = true
         TreasureData::Config.ssl_verify = false
-        expect(TreasureData::Config.cl_options_string).to include('--insecure')
+        expect(TreasureData::Config.cl_options_string).to include('--ssl-verify false')
       end
 
-      it 'does not include --insecure when cl_ssl_verify is false' do
+      it 'does not include --ssl-verify when cl_ssl_verify is false' do
         TreasureData::Config.cl_ssl_verify = false
-        expect(TreasureData::Config.cl_options_string).not_to include('--insecure')
+        expect(TreasureData::Config.cl_options_string).not_to include('--ssl-verify')
       end
 
-      it 'includes --ssl-ca-file when cl_ssl_ca_file is true' do
+      it 'includes --ssl-verify with CA file path when cl_ssl_ca_file is true' do
         TreasureData::Config.cl_ssl_ca_file = true
         TreasureData::Config.ssl_ca_file = '/path/to/ca.crt'
-        expect(TreasureData::Config.cl_options_string).to include('--ssl-ca-file /path/to/ca.crt')
+        expect(TreasureData::Config.cl_options_string).to include('--ssl-verify /path/to/ca.crt')
       end
 
-      it 'does not include --ssl-ca-file when cl_ssl_ca_file is false' do
+      it 'does not include --ssl-verify when cl_ssl_ca_file is false' do
         TreasureData::Config.cl_ssl_ca_file = false
-        expect(TreasureData::Config.cl_options_string).not_to include('--ssl-ca-file')
+        expect(TreasureData::Config.cl_options_string).not_to include('--ssl-verify')
       end
 
       it 'properly escapes CA file paths with spaces' do
         TreasureData::Config.cl_ssl_ca_file = true
         TreasureData::Config.ssl_ca_file = '/path/with spaces/ca.crt'
-        expect(TreasureData::Config.cl_options_string).to include('--ssl-ca-file /path/with\\ spaces/ca.crt')
+        expect(TreasureData::Config.cl_options_string).to include('--ssl-verify /path/with\\ spaces/ca.crt')
       end
 
       it 'properly escapes CA file paths with special characters' do
         TreasureData::Config.cl_ssl_ca_file = true
         TreasureData::Config.ssl_ca_file = '/path/with$special&chars/ca.crt'
-        expect(TreasureData::Config.cl_options_string).to include('--ssl-ca-file /path/with\\$special\\&chars/ca.crt')
+        expect(TreasureData::Config.cl_options_string).to include('--ssl-verify /path/with\\$special\\&chars/ca.crt')
       end
     end
 

From e1d58d4794253e48b8ce901166f0a4e16cd0ec08 Mon Sep 17 00:00:00 2001
From: Mikio Tachibana <m.tachibana25@gmail.com>
Date: Fri, 20 Jun 2025 19:18:43 +0900
Subject: [PATCH 7/7] fix

---
 lib/td/command/common.rb |  7 ++--
 lib/td/command/runner.rb |  8 ++--
 lib/td/config.rb         | 81 +++++++++++++++++++++++-----------------
 3 files changed, 54 insertions(+), 42 deletions(-)

diff --git a/lib/td/command/common.rb b/lib/td/command/common.rb
index b62611a..9489b7a 100644
--- a/lib/td/command/common.rb
+++ b/lib/td/command/common.rb
@@ -42,10 +42,11 @@ def get_client(opts={})
     end
 
     # SSL verification options
-    if Config.ssl_verify == false
+    ssl_option = Config.ssl_option
+    if ssl_option == false || (ssl_option.is_a?(String) && ssl_option.downcase == 'false')
       opts[:verify] = false
-    elsif Config.ssl_ca_file
-      opts[:verify] = Config.ssl_ca_file
+    elsif ssl_option.is_a?(String) && ssl_option.downcase != 'false'
+      opts[:verify] = ssl_option
     end
 
     # apikey is mandatory
diff --git a/lib/td/command/runner.rb b/lib/td/command/runner.rb
index eac6b8f..60577d2 100644
--- a/lib/td/command/runner.rb
+++ b/lib/td/command/runner.rb
@@ -164,13 +164,13 @@ def run(argv=ARGV)
         Config.cl_import_endpoint = true
       end
       if insecure
-        Config.ssl_verify = false
-        Config.cl_ssl_verify = true
+        Config.ssl_option = false
+        Config.cl_ssl_option = true
         $stderr.puts "Warning: --insecure option disables SSL certificate verification, which is not recommended for production use."
       end
       if ssl_ca_file
-        Config.ssl_ca_file = ssl_ca_file
-        Config.cl_ssl_ca_file = true
+        Config.ssl_option = ssl_ca_file
+        Config.cl_ssl_option = true
       end
       if retry_post_requests
         Config.retry_post_requests = true
diff --git a/lib/td/config.rb b/lib/td/config.rb
index e5e0aa2..52e1365 100644
--- a/lib/td/config.rb
+++ b/lib/td/config.rb
@@ -26,11 +26,8 @@ class Config
   @@cl_import_endpoint = false # flag to indicate whether an endpoint has been provided through the command-line option
   @@secure = true
   @@retry_post_requests = false
-  @@ssl_verify = ENV['TD_SSL_VERIFY'].nil? ? true : (ENV['TD_SSL_VERIFY'].downcase == 'false' ? false : true)
-  @@ssl_ca_file = ENV['TD_SSL_CA_FILE']
-  @@ssl_ca_file = nil if @@ssl_ca_file == ""
-  @@cl_ssl_verify = false # flag to indicate whether ssl verify has been provided through the command-line
-  @@cl_ssl_ca_file = false # flag to indicate whether ssl ca file has been provided through the command-line
+  @@ssl_option = ENV['TD_SSL_VERIFY'] || ENV['TD_SSL_CA_FILE'] || true
+  @@cl_ssl_option = false # flag to indicate whether ssl option has been provided through the command-line
 
   def initialize
     @path = nil
@@ -199,60 +196,72 @@ def self.workflow_endpoint
     end
   end
 
-  def self.ssl_verify
-    if @@cl_ssl_verify
-      return @@ssl_verify
+  def self.ssl_option
+    if @@cl_ssl_option
+      return @@ssl_option
     end
 
     begin
       conf = read
       if conf['ssl.verify']
-        return conf['ssl.verify'].downcase == 'false' ? false : true
+        return conf['ssl.verify'].downcase == 'false' ? false : conf['ssl.verify']
+      elsif conf['ssl.ca_file']
+        return conf['ssl.ca_file']
       end
     rescue ConfigNotFoundError
     end
 
-    return @@ssl_verify
+    return @@ssl_option
   end
 
-  def self.ssl_verify=(verify)
-    @@ssl_verify = verify
+  def self.ssl_option=(option)
+    @@ssl_option = option
   end
 
-  def self.cl_ssl_verify
-    @@cl_ssl_verify
+  def self.cl_ssl_option
+    @@cl_ssl_option
   end
 
-  def self.cl_ssl_verify=(flag)
-    @@cl_ssl_verify = flag
+  def self.cl_ssl_option=(flag)
+    @@cl_ssl_option = flag
   end
 
-  def self.ssl_ca_file
-    if @@cl_ssl_ca_file
-      return @@ssl_ca_file
-    end
+  # Compatibility methods for existing code
+  def self.ssl_verify
+    option = ssl_option
+    return false if option == false || (option.is_a?(String) && option.downcase == 'false')
+    return true if option == true || option.nil?
+    return true # if it's a file path, verification is enabled
+  end
 
-    begin
-      conf = read
-      if conf['ssl.ca_file']
-        return conf['ssl.ca_file']
-      end
-    rescue ConfigNotFoundError
-    end
+  def self.ssl_verify=(verify)
+    self.ssl_option = verify
+  end
 
-    return @@ssl_ca_file
+  def self.ssl_ca_file
+    option = ssl_option
+    return option if option.is_a?(String) && option.downcase != 'false' && File.exist?(option)
+    return nil
   end
 
   def self.ssl_ca_file=(ca_file)
-    @@ssl_ca_file = ca_file
+    self.ssl_option = ca_file
+  end
+
+  def self.cl_ssl_verify
+    @@cl_ssl_option
+  end
+
+  def self.cl_ssl_verify=(flag)
+    @@cl_ssl_option = flag
   end
 
   def self.cl_ssl_ca_file
-    @@cl_ssl_ca_file
+    @@cl_ssl_option
   end
 
   def self.cl_ssl_ca_file=(flag)
-    @@cl_ssl_ca_file = flag
+    @@cl_ssl_option = flag
   end
 
   # renders the apikey and endpoint options as a string for the helper commands
@@ -265,10 +274,12 @@ def self.cl_options_string
     string += "--import-endpoint #{@@import_endpoint} " if @@cl_import_endpoint
     
     # Handle simplified SSL option
-    if @@cl_ssl_verify && !@@ssl_verify
-      string += "--ssl-verify false "
-    elsif @@cl_ssl_ca_file && @@ssl_ca_file
-      string += "--ssl-verify #{Shellwords.escape(@@ssl_ca_file)} "
+    if @@cl_ssl_option && @@ssl_option
+      if @@ssl_option == false || (@@ssl_option.is_a?(String) && @@ssl_option.downcase == 'false')
+        string += "--ssl-verify false "
+      elsif @@ssl_option.is_a?(String)
+        string += "--ssl-verify #{Shellwords.escape(@@ssl_option)} "
+      end
     end
     
     string