265

When I run bundle install for my Rails 3 project on Centos 5.5 it fails with an error:

Gem::RemoteFetcher::FetchError: SSL_connect returned=1 errno=0 state=SSLv3 
read server certificate B: certificate verify failed 
(https://bb-m.rubygems.org/gems/multi_json-1.3.2.gem)
An error occured while installing multi_json (1.3.2), and Bundler cannot continue.
Make sure that `gem install multi_json -v '1.3.2'` succeeds before bundling.

When I try to install the gem manually (by gem install multi_json -v '1.3.2') it works. The same problem occurs with several other gems. I use RVM (1.12.3), ruby 1.9.2, bundler 1.1.3.

How to fix it?

mrzasa
  • 22,895
  • 11
  • 56
  • 94
  • Facing the same problem. But with another gem: Gem::RemoteFetcher::FetchError: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed (https://bb-m.rubygems.org/gems/activeresource-3.2.3.gem) – Sathish Apr 20 '12 at 16:31
  • 4
    I am having the same error with the same circumstances. I suspect, given these other responses, that it's a server-side issue. – asfallows Apr 20 '12 at 16:47
  • I had a similar problem in Rails 5. Fixed it by adding `source "https://rubygems.org''` in the Gemfile and running 'gem update --system'. You can find more info [here](https://kolosek.com/rails-bundle-install-and-gemfile). – Nesha Zoric Mar 09 '18 at 15:25
  • Nesha, that fix worked for me. Thank you! – Martin Marino Aug 15 '18 at 18:22

29 Answers29

313

Update

Now that I've karma wh..err mined enough from this answer everyone should know that this should have been fixed.

re: via Ownatik again bundle install fails with SSL certificate verification error

gem update --system

My answer is still correct and left below for reference if that ends up not working for you.


Honestly the best temporary solution is to

[...] use the non-ssl version of rubygems in your gemfile as a temporary workaround.

via user Ownatik

what they mean is at the top of the Gemfile in your rails application directory change

source 'https://rubygems.org'

to

source 'http://rubygems.org'

note that the second version is http instead of https

Community
  • 1
  • 1
Will
  • 4,358
  • 2
  • 20
  • 17
  • 1
    I'm accepting this answer, because that was the thing that I did at first. Later I changed my deploy strategy. Now I run bundle the application on another server and then I copy it (with gems in `vendor` directory) to the server I wrote about in the question. – mrzasa May 02 '12 at 06:48
  • 7
    This didn't work for me. [The link](http://railsapps.github.com/openssl-certificate-verify-failed.html) provided by @fbernier below fixed it for me. – Scott Fister Oct 01 '13 at 20:10
  • I also had to follow that link by @fbernier, particularly in that page's "alternative" section – Ben Wheeler Oct 08 '13 at 16:32
  • 5
    This doesn't work. Running this just provides output of `Latest version currently installed. Aborting.` Any other ideas? – Matt Huggins Nov 03 '13 at 22:49
  • Read [this answer](http://stackoverflow.com/questions/16913828/ssl-connect-returned-1-errno-0-state-sslv3-read-server-certificate-b-certifica) TL;DR: `apt-get install openssl ca-certificates` – wrdevos Nov 26 '13 at 12:53
  • 1
    In terms of changing the source, for newer people like me. I would specify that this file is located in your application directory. I was looking for it in the railsinstaller directory. Anyways, I changed the source and it finally worked. I am getting certificate errors when I try to run the update :( – Brian Jan 14 '14 at 21:16
  • This did not work for me. Using Debian Jessie within Docker. Ruby 2.1.5p273, Gem 2.4.5, Bundler 1.7.8 – Populus Dec 09 '14 at 03:10
  • With certificate issues: changing the source to insecure: gem sources -a http:// rubygems.org/ (don't forget to put secure back) – Frankey Dec 14 '14 at 20:39
  • 3
    `gem update --system` fails with the exact same certificate error :\ – BlueRaja - Danny Pflughoeft Dec 16 '14 at 16:23
  • 1
    This is an application-specific solution. Flextra provided a true solution. – Paul Dec 16 '14 at 21:54
  • @Paul. I said in my answer this is a temporary solution. Thanks for pointing to Flextra's answer. Hopefully that works for others. I will still leave mine here because sometimes those other solutions dont work for everyone. This works regardless of external factors. and for someone who is just learning rails and just wants things to work that is fine – Will Dec 17 '14 at 02:40
  • perfect answer, i had spent a lot of time searching for this answer –  Jan 04 '15 at 08:47
  • Hey can anyone please tell me where can we find the Gemfile in Ruby,it would be thanks if u specify the path – khan Feb 26 '15 at 20:18
  • 1
    just incase if you are using RVM and the above solution doesnt work (which happened to me). just run `rvm osx-ssl-certs update all`. This wil update all certificates. more info here -> http://railsapps.github.io/openssl-certificate-verify-failed.html – sujay Oct 14 '16 at 20:05
  • @sujay that doesn't seem to help. I get the same error as Danny. – Andy Hayden Jan 04 '17 at 00:59
  • This sent me into a whole world of needing new RVM and bundler and ruby... – Alien Life Form Jan 10 '17 at 19:56
  • I experience `Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://rubygems.org/` because we have enterprise Sophos firewall and I must somehow install Sophos certificate into gem system so that bundler will use it. How to do this? – Paul Sep 05 '17 at 09:16
229

Replace the ssl gem source with non-ssl as a temp solution:

StuR
  • 12,042
  • 9
  • 45
  • 66
  • 8
    OMG worked like a charm! I'm on Windows 7 x64 behind a corporate proxy. Thanks a lot! – Șerban Ghiță Sep 27 '13 at 09:39
  • 15
    I'm surprised this was not ranked higher, this was the easiest quick fix. – hwatkins Oct 01 '13 at 19:41
  • 3
    good temp solution...be aware of the following :: RubyGems has been configured to serve gems via the following URLs through its history: * http://gems.rubyforge.org (RubyGems 1.3.6 and earlier) * http://rubygems.org (RubyGems 1.3.7 through 1.8.25) * https://rubygems.org (RubyGems 2.0.1 and newer) – beauXjames Oct 09 '13 at 18:46
  • 1
    fastest solution for me on Windows 8 – Tisch Dec 14 '14 at 01:05
  • 1
    Problem is that it still attempts to get gem metadata from the https source. Any way to override this? – Ray Suelzer Dec 30 '14 at 20:06
  • @RaySuelzer the path should match exactly that string that in your options. type `gem sources` and watch actial value. then remove it. then add non https. anyway read my comment to be sure of desired behaviour. – Alexander.Iljushkin Apr 15 '15 at 07:41
  • Also, make sure you're not MITMing yourself. I forgot I was running Charles Proxy. /facepalm – joshbodily Jul 18 '16 at 21:56
  • 4
    Imho this should not even be considered a valid answer, because it opens up your system to attacks from outside. – rubiii Jan 31 '17 at 22:03
  • Works on Windows 10 ! It's not the safest solution but really works. – riroo Feb 10 '17 at 09:53
  • This one won't work anymore. Guys at rubygems put stricter settings in place and non-http version is now redirected to https automatically since couple days ago. – Kepi Dec 10 '20 at 18:51
163

The reason is old rubygems. You need to update system part using non ssl source first:

gem update --system --source http://rubygems.org/ (temporarily updating system part using non-ssl connection).

Now you're ready to use gem update.

Alexander.Iljushkin
  • 4,519
  • 7
  • 29
  • 46
  • 5
    Really simple solution that's cross-platform and allows RubyGems to take care of the details. Nice. – zrisher Dec 19 '14 at 02:53
  • 2
    this was the one that should be accepted, the answers above don't explain that you need to remove the ssl sources first – Ephraim Feb 11 '15 at 20:54
  • 1
    Thanks - this is the ticket. If you get a "not in cache" message when adding or removing sources, try it with or without a trailing slash. It has to match exactly. – Timothy Lee Russell Mar 25 '15 at 23:17
  • 1
    I have searched trough many solutions. This is the one worked like a charm. Thank you! This should be choosen as the true solution. – Berker Yüceer Sep 10 '15 at 13:49
  • 1
    Thank you!! I agree with others that this should be the accepted answer, as it doesn't result in you fetching gems through plain HTTP. – Alexander Oct 24 '15 at 16:19
  • 1
    if it is temporary fix why not to add `--source http://rubygems.org/`at the end of your install command? – DragonKnight Jan 04 '16 at 21:05
  • @user3705055 thanks, please, review changes for correctness. – Alexander.Iljushkin Sep 13 '16 at 07:55
  • 1
    November 2016, and yet, this is still the only answer that works. Thanks! – Manish Giri Nov 16 '16 at 06:10
  • 1
    This doesn't seem to work for me (somehow still get an SSL error). EDIT: This worked in conjunction with asfallows' answer http://stackoverflow.com/a/10250470/1240268) – Andy Hayden Jan 04 '17 at 01:00
118

If you're on a mac and use a recent version of RVM (~1.20), the following command worked for me.

rvm osx-ssl-certs update
chaserx
  • 1,461
  • 1
  • 14
  • 13
55

This issue should now be fixed. Update rubygems (gem update --system), make sure openssl is at the latest version on your OS, or try these tips of it's still not working: http://railsapps.github.com/openssl-certificate-verify-failed.html

JJD
  • 50,076
  • 60
  • 203
  • 339
fbernier
  • 12,278
  • 2
  • 24
  • 30
  • 1
    Needed to update bundler as well to make it work (rubygems 2.0.3 + bundler 1.3.2 + cygwin openssl 1.0.1e works for me on winxp). – fakeleft Mar 12 '13 at 14:48
  • I had to update from 1.3.0, now I am on 1.3.4 and the https is no longer throwing the error: bundler-1.3.0/lib/bundler/vendor/net/http/persistent/ssl_reuse.rb:70:in `connect': SSL_connect returned=1 errno=0 state=SSLv3 read server key exchange B: bad ecpoint (OpenSSL::SSL::SSLError) – Jon Kern Apr 03 '13 at 02:50
  • 3
    It is not possible to update rubygems if the SSL certificate is not accepted! Running in circles here ;) – kap Jan 15 '15 at 21:28
53

Temporary solution (as alluded to by Ownatik):

Create or modify a file called .gemrc in your home path, including the line :ssl_verify_mode: 0

This will prevent bundler from checking the SSL certificates of gems when it attempts to install them.

For *nix devices, 'home path' means ~/.gemrc. You can also create /etc/gemrc if you prefer. For Windows XP, 'home path' means c:\Documents and Settings\All Users\Application Data\gemrc. For Windows 7, C:\ProgramData\gemrc

asfallows
  • 5,998
  • 6
  • 29
  • 48
18

On windows7 you can download the cacert.pem file from here and set the environementvariable SSL_CERT_FILE to the path where you store the certificate eg

SET SSL_CERT_FILE="C:\users\<username>\cacert.pem"

or you can set the variable in your script like this ENV['SSL_CERT_FILE']="C:/users/<username>/cacert.pem"

Replace <username> with you own username.

peter
  • 41,770
  • 5
  • 64
  • 108
15

The real solution to this problem, if you are using RVM:

  1. Update rubygems: gem update --system
  2. Use RVM to refresh SSL certs: rvm osx-ssl-certs update all

Hat tip to this tip on the RailsApps project!

Alan H.
  • 16,219
  • 17
  • 80
  • 113
  • 1
    `rvm osx-ssl-certs update all` worked fine for me. Didnt need to to do step 1. – DMH Jul 24 '15 at 14:02
9

You can download a list of CA certificates from curl's website at http://curl.haxx.se/ca/cacert.pem

Then set the SSL_CERT_FILE environment variable to tell Ruby to use it. For example, in Linux:

$ SSL_CERT_FILE=~/cacert.pem bundle install

(Reference: https://gist.github.com/fnichol/867550)

arcanex
  • 91
  • 1
  • 1
  • On Debian Buster I had to do this: `SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt gem update --system` – nitrogen Mar 08 '21 at 02:44
7

For those of you that have ruby installed through RVM and want a quick fix (preferring not to read per Bruno's request) just try this:

rvm remove 1.9.x (or whatever version of ruby you are using)
rvm pkg install openssl
rvm install 1.9.2 --with-openssl-dir=$rvm_path/usr

For a more details, here is the link where I found the solution.

http://railsapps.github.com/openssl-certificate-verify-failed.html

BTW, I didn't have to touch my certificates on Ubuntu.

Best of all, this isn't a workaround. It will download gems through SSL and fail if there if there is a problem like a man in the middle attack which is much better than just turning off security.

  • The page you link to has a "workaround" (first) and then proper solutions. It would be better if your answer stated that a bit more clearly. Nevertheless, using CA certificates (via `cacert.pem` or `$rvm_path/usr/ssl`) is indeed the right way to go. – Bruno Apr 27 '12 at 19:43
  • 1
    Bruno, the solution will probably be a bit different depending on what flavor of Unix the person uses. It looks like reading the link will be necessary. – danielrussia Apr 28 '12 at 12:19
  • I was just talking about the difference between the "workaround" on the page (`:ssl_verify_mode: 0`, which open problems), as opposed to any of the 3 solutions below it, which are the right way to fix this problem. – Bruno Apr 28 '12 at 12:30
  • @Bruno, I've revised my article, please add comments or edit the wiki if you see possibilities for improvements. – Daniel Kehoe Apr 29 '12 at 01:16
6

This has been fixed

http://guides.rubygems.org/ssl-certificate-update/

Now that RubyGems 2.6.x has been released, you can manually update to this version.

Download https://rubygems.org/downloads/rubygems-update-2.6.7.gem

Please download the file in a directory that you can later point to (eg. the root of your harddrive C:)

Now, using your Command Prompt:

C:\>gem install --local C:\rubygems-update-2.6.7.gem
C:\>update_rubygems --no-ri --no-rdoc

After this, gem --version should report the new update version.

You can now safely uninstall rubygems-update gem:

C:\>gem uninstall rubygems-update -x
Roffers
  • 691
  • 1
  • 8
  • 16
5

Simple copy paste instruction given here about .pem file

https://gist.github.com/luislavena/f064211759ee0f806c88

For certificate verification failed

If you've read the previous sections, you will know what this means (and shame > on you if you have not).

We need to download AddTrustExternalCARoot-2048.pem. Open a Command Prompt and type in:

C:>gem which rubygems C:/Ruby21/lib/ruby/2.1.0/rubygems.rb Now, let's locate that directory. From within the same window, enter the path part up to the file extension, but using backslashes instead:

C:>start C:\Ruby21\lib\ruby\2.1.0\rubygems This will open a Explorer window inside the directory we indicated.

Step 3: Copy new trust certificate

Now, locate ssl_certs directory and copy the .pem file we obtained from previous step inside.

It will be listed with other files like GeoTrustGlobalCA.pem.

nurettin
  • 11,090
  • 5
  • 65
  • 85
geniushkg
  • 706
  • 9
  • 21
4

same problem but with different gem here:

Gem::RemoteFetcher::FetchError: SSL_connect returned=1 errno=0 state=SSLv3 
read server certificate B: certificate verify failed 
(https://bb-m.rubygems.org/gems/builder-3.0.0.gem)
An error occured while installing builder (3.0.0), and Bundler cannot continue.
Make sure that `gem install builder -v '3.0.0'` succeeds before bundling.

temporarily solution: gem install builder -v '3.0.0' makes it possible to continue bundle install

mrzasa
  • 22,895
  • 11
  • 56
  • 94
Ludwig
  • 49
  • 1
4

The simplest solution:

rvm pkg install openssl
rvm reinstall all --force

Voila!

austin
  • 5,816
  • 2
  • 32
  • 40
4

This is How you fix this problem on Windows:

download .perm file then set the SSL_CERT_FILE in command prompt

https://gist.github.com/fnichol/867550

bkdir
  • 998
  • 7
  • 12
4

My permanent fix for Windows:

  1. Download the CACert , save as C:\ruby\ssl_certs\GlobalSignRootCA.pem from http://guides.rubygems.org/ssl-certificate-update/

  2. Create system variable named "SSL_CERT_FILE", set to C:\ruby\ssl_certs\GlobalSignRootCA.pem.

  3. Try again: gem install bundler:

C:\gem sources
*** CURRENT SOURCES ***
https://rubygems.org/

C:\gem install bundler
Fetching: bundler-1.13.5.gem (100%)
Successfully installed bundler-1.13.5
1 gem installed
Dio Phung
  • 5,944
  • 5
  • 37
  • 55
3

I get a slightly different error, though perhaps related, on Ubuntu 12.04:

Gem::RemoteFetcher::FetchError: SSL_connect returned=1 errno=0 state=unknown state: sslv3 alert handshake failure (https://d2chzxaqi4y7f8.cloudfront.net/gems/activesupport-3.2.3.gem)
An error occured while installing activesupport (3.2.3), and Bundler cannot continue.
Make sure that `gem install activesupport -v '3.2.3'` succeeds before bundling.

It happens when I run bundle install with source 'https://rubygems.org' in a Gemfile.

This is an issue with OpenSSL on Ubuntu 12.04. See Rubygems issue #319.

To fix this, run apt-get update && apt-get upgrade on Ubuntu 12.04 to upgrade your OpenSSL.

Jo Liss
  • 30,333
  • 19
  • 121
  • 170
3

I was able to track this down to the fact that the binaries that rvm downloads do not play nice with OS X's OpenSSL, which is old and is no longer used by the OS.

The solution for me was to force compilation when installing Ruby via rvm:

rvm reinstall --disable-binary 2.2
Schrockwell
  • 838
  • 1
  • 8
  • 25
3

Thx to @Alexander.Iljushkin for:

gem update --system --source http://rubygems.org/

After that bundler still failed and the solution to that was:

gem install bundler

Sebastian Ax
  • 1,240
  • 12
  • 11
2

I was getting a similar error. Here is how I solved this: In your path directory, check for Gemfile. Edit the source in the gemfile to http instead of https and save it. This might install the bundler without the SSL certificate issue.l

ecksor5
  • 21
  • 1
2

For Windows machine, check your gem version with

gem --version

Then update your gem as follow:

Please download the file in a directory that you can later point to (eg. the root of your hard drive C:)

Now, using your Command Prompt:

C:\>gem install --local C:\rubygems-update-1.8.30.gem
C:\>update_rubygems --no-ri --no-rdoc

Now, bundle install will success without SSL certificate verification error.

More detailed instruction is here

KBIIX
  • 873
  • 9
  • 14
1

This worked for me:

  • download latest gem at https://rubygems.org/pages/download
  • install the gem with gem install --local [path to downloaded gem file]
  • update the gems with update_rubygems
  • check that you're on the latest gem version with gem --version
Guy Chauliac
  • 640
  • 7
  • 8
1

I had to reinstall openssl:

brew uninstall --force openssl
brew install openssl
gabeodess
  • 2,006
  • 21
  • 13
1

I was just recently faced with this issue and followed the steps outlined here. There might be a chance that you are not pointing to the right OpenSSL certificate. After running:

rvm osx-ssl-certs status all
rvm osx-ssl-certs update all

and

export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt

the bundle complete ran!

jshaf
  • 309
  • 1
  • 18
1

Download rubygems-update-2.6.7.gem .

Now, using your Command Prompt:

C:\>gem install --local C:\rubygems-update-2.6.7.gem
C:\>update_rubygems --no-ri --no-rdoc

After this, gem --version should report the new update version.

You can now safely uninstall rubygems-update gem:

C:\>gem uninstall rubygems-update -x
Removing update_rubygems
Successfully uninstalled rubygems-update-2.6.7
Aswathy
  • 654
  • 1
  • 12
  • 26
1

To note, if you're grabbing gems from a source which SSL cert is trusted by an internal certificate authority (or you are connecting to an external source through a company web proxy with SSL inspection), point your SSL_CERT_FILE env variable to your certificate chain. This most likely just requires exporting your root certificate from your certificate store (System Keychain on macOS) to an accessible location from your shell i.e.:

export SSL_CERT_FILE=~/RootCert.pem
1

If you're using rails-assets

If you were using https://rails-assets.org/ to manage your assets, no answers will help you. Even converting to http won't help.

The simplest fix is using this source instead, http://insecure.rails-assets.org. This has been mentioned in their homepage.

Community
  • 1
  • 1
Anwar
  • 1,755
  • 1
  • 21
  • 32
0

The only thing that worked for me on legacy windows system and ruby 1.9 version is downloading cacert file from http://guides.rubygems.org/ssl-certificate-update/

And then running below command before running bundle install

bundle config --global ssl_ca_cert /path/to/file.pem
Aleksandar Pavić
  • 3,143
  • 1
  • 34
  • 36
0

Here is what I came up by looking at Rubygems code, add that line to your .gemrc file:

:ssl_ca_cert: /<path to your own CA cert >/cacert.cer
bioffe
  • 6,283
  • 3
  • 50
  • 65