SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed

Question

I am using Authlogic-Connect for third party logins. After running appropriate migrations, Twitter/Google/yahoo logins seem to work fine but the facebook login throws exception:

SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed

The dev log shows

OpenSSL::SSL::SSLError (SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed):
  app/controllers/users_controller.rb:37:in `update'

Please suggest..

Here is a the best solution I was able to find so far http://stackoverflow.com/a/16983443/11792 — Pavel Nikolov, Jun 07 '13 at 12:06

score 140 · Answer 1 · edited Jul 31 '14 at 11:23

140

I ran into a similar problem when trying to use the JQuery generator for Rails 3

I solved it like this:

Get the CURL Certificate Authority (CA) bundle. You can do this with:
- sudo port install curl-ca-bundle [if you are using MacPorts]
- or just pull it down directly wget http://curl.haxx.se/ca/cacert.pem
Execute the ruby code that is trying to verify the SSL certification: SSL_CERT_FILE=/opt/local/etc/certs/cacert.pem rails generate jquery:install. In your case, you want to either set this as an environment variable somewhere the server picks it up or add something like ENV['SSL_CERT_FILE'] = /path/to/your/new/cacert.pem in your environment.rb file.

You can also just install the CA files (I haven't tried this) to the OS -- there are lengthy instructions here -- this should work in a similar fashion, but I have not tried this personally.

Basically, the issue you are hitting is that some web service is responding with a certificate signed against a CA that OpenSSL cannot verify.

edited Jul 31 '14 at 11:23

askmish

6,464
23
42

answered May 12 '11 at 05:42

Erik G.

1,599
1
9
5

1

This worked for me too while trying to connect to my gmail account using Ruby Net::IMAP from a ruby script.Thanks. – Jignesh Gohel Mar 26 '12 at 20:01
4

Yes, this works fine on ruby-1.9.3. I added it to my bash config. `export SSL_CERT_FILE=/usr/local/etc/openssl/certs/cert.pem` – andersjanmyr Dec 20 '12 at 12:04
5

I didn't have /usr/local/etc/openssl, so I ran `sudo curl http://curl.haxx.se/ca/cacert.pem >> /usr/local/etc/cacert.pem` followed by `export SSL_CERT_FILE=/usr/local/etc/cacert.pem` – Lilith River Mar 06 '13 at 14:05
I was able to fix this on OS X without setting any environment variables. I'm not sure if I had the same exact problem, but I was getting the same error. For me it was just a matter of putting the cert.pem file in the right place. More details here: http://stackoverflow.com/a/16741712/62 – Liron Yahdav May 24 '13 at 19:00
5

Developing on my Mac I just added `SSL_CERT_FILE=/usr/local/etc/openssl/cert.pem` to my app's `.env` file and voila - all happy. – Dave Sag Sep 30 '13 at 09:36
11

I appreciate the irony of using wget to download curl certificates. – Trey Oct 06 '14 at 22:47
This works on Windows as well: http://stackoverflow.com/questions/27435841/windows-7-64-bit-could-not-find-a-valid-gem-compass-0-here-is-why-unab – Jeff Jan 15 '15 at 13:07
I was able to fix this just by upgrading openssl. `brew update`, `brew upgrade openssl`. – jwadsack Jun 26 '15 at 15:22
Having a rails app this is what worked for me: do step 1, then place the downloaded cert file into config folder, add in your development.rb the line ENV['SSL_CERT_FILE'] = 'config/cacert.pem' – Denis Sep 02 '15 at 10:20

score 139 · Answer 2 · edited May 23 '17 at 11:47

139

If you're using RVM on OS X, you probably need to run this:

rvm osx-ssl-certs update all

More information here: http://rvm.io/support/fixing-broken-ssl-certificates

And here is the full explanation: https://github.com/wayneeseguin/rvm/blob/master/help/osx-ssl-certs.md

Update

On Ruby 2.2, you may have to reinstall Ruby from source to fix this. Here's how (replace 2.2.3 with your Ruby version):

rvm reinstall 2.2.3 --disable-binary

Credit to https://stackoverflow.com/a/32363597/4353 and Ian Connor.

edited May 23 '17 at 11:47

Community

1
1

answered Aug 20 '13 at 20:03

htanata

36,666
8
50
57

2

Here is a much more comprehensive writeup with alternatives: http://railsapps.github.io/openssl-certificate-verify-failed.html – Peter P. Nov 18 '13 at 19:15
ERROR: rvm update has been removed. See 'rvm get' and rvm 'rubygems' CLI API instead – yang Apr 13 '14 at 05:10
@user432506 How did you get that error? I'm using latest stable RVM and it still works. – htanata Apr 14 '14 at 17:28
I am using pod install,and this method work perfectly,thanks a lot. – inix Mar 11 '15 at 05:56
4

This would work for a while, then fail for me. What worked for me was running `rvm reinstall 2.2.0 --disable-binary` but then you have to bundle install and start fresh. – Ian Connor Nov 03 '15 at 02:42
@IanConnor Yes, I've just encountered this issue yesterday and planned to update my answer. Thank you! – htanata Nov 03 '15 at 19:25
@IanConnor you saved me. This worked under 10.11.3 / rvm ruby 2.2.3 very much appreciated, sir. – fmquaglia Feb 18 '16 at 00:20

score 130 · Answer 3 · edited Jun 20 '20 at 09:12

130

Here's how you can fix it on Windows: https://gist.github.com/867550 (created by Fletcher Nichol)

Excerpt:

The Manual Way (Boring)

Download the cacert.pem file from http://curl.haxx.se/ca/cacert.pem. Save this file to C:\RailsInstaller\cacert.pem.

Now make ruby aware of your certificate authority bundle by setting SSL_CERT_FILE. To set this in your current command prompt session, type:
set SSL_CERT_FILE=C:\RailsInstaller\cacert.pem
To make this a permanent setting, add this in your control panel.

edited Jun 20 '20 at 09:12

Community

1
1

answered Sep 24 '11 at 04:02

ryanjones

5,383
4
28
24

6

Thank you. This is exceptionally useful and also very simple. – John Mar 14 '12 at 07:26
The above solution didn't help me. This is a better guide for Windows: http://stackoverflow.com/questions/5720484/how-to-solve-certificate-verify-failed-on-windows – Sprachprofi Jun 01 '12 at 08:33
@Sprachprofi The solution you've linked to will only work for 1 rails project at a time (as you're pointing directly to that cert). The gist I've linked to (created by Fletcher Nichol) will allow it to cover every project/gem that's looking for a certificate. – ryanjones Jun 01 '12 at 15:17

score 31 · Answer 4 · edited May 31 '13 at 17:50

31

Ruby can't find any root certificates to trust.

Take a look at this blog post for a solution: "Ruby 1.9 and the SSL error".

The solution is to install the curl-ca-bundle port which contains the same root certificates used by Firefox:
sudo port install curl-ca-bundle
and tell your https object to use it:
https.ca_file = '/opt/local/share/curl/curl-ca-bundle.crt'
Note that if you want your code to run on Ubuntu, you need to set the ca_path attribute instead, with the default certificates location /etc/ssl/certs.

edited May 31 '13 at 17:50

Epu

615
8
18

answered Dec 31 '10 at 06:48

martoche

509
4
3

8

This seems to happen on Windows as well, in which case the solution recommended there won't work. – Bob Aman Nov 16 '11 at 15:38

score 24 · Answer 5 · edited Sep 01 '15 at 05:50

24

The reason that you get this error on OSX is the rvm-installed ruby.

If you run into this issue on OSX you can find a really broad explanation of it in this blog post:

http://toadle.me/2015/04/16/fixing-failing-ssl-verification-with-rvm.html

The short version is that, for some versions of Ruby, RVM downloads pre-compiled binaries, which look for certificates in the wrong location. By forcing RVM to download the source and compile on your own machine, you ensure that the configuration for the certificate location is correct.

The command to do this is:

rvm install 2.2.0 --disable-binary

if you already have the version in question, you can re-install it with:

rvm reinstall 2.2.0 --disable-binary

(obviously, substitute your ruby version as needed).

edited Sep 01 '15 at 05:50

Ben Hull

7,524
3
36
56

answered Jul 24 '15 at 18:01

paulmorar

353
3
12

This worked for me. The blog post you're pointing to is also useful, thanks! – Cristian Sep 04 '15 at 09:25
2

This worked for me on El Capitan. I imploded rvm (rvm implode). Installed again with `\curl -sSL https://get.rvm.io | bash -s stable --autolibs=homebrew` and then `rvm install --disable-binary` At one point I also did `rvm get head` as these are some bleeding edge issues. – rylanb Oct 24 '15 at 23:06
Only this solution worked for me, because originally I had Ruby 2.0.0 on El Capitan and for some reason that older version didn't work even with correct `SSL_CERT_FILE`. After `rvm install 2.2.0 --disable-binary`, the issue sorted. – laimison Jun 29 '18 at 11:34

score 20 · Answer 6 · answered May 07 '12 at 03:37

20

The issue is that ruby can not find a root certificate to trust. As of 1.9 ruby checks this. You will need to make sure that you have the curl certificate on your system in the form of a pem file. You will also need to make sure that the certificate is in the location that ruby expects it to be. You can get this certificate at...

http://curl.haxx.se/ca/cacert.pem

If your a RVM and OSX user then your certificate file location will vary based on what version of ruby your using. Setting the path explicitly with :ca_path is a BAD idea as your code will not be portable when it gets to production. There for you want to provide ruby with a certificate in the default location(and assume your dev ops guys know what they are doing). You can use dtruss to work out where the system is looking for the certificate file.

In my case the system was looking for the cert file in

/Users/stewart.matheson/.rvm/usr/ssl/cert.pem

however MACOSX system would expect a certificate in

/System/Library/OpenSSL/cert.pem

I copied the downloaded cert to this path and it worked. HTH

answered May 07 '12 at 03:37

Stewart

3,023
2
24
40

2

For me on Ubuntu 12.04, the cert path which works is `~/.rvm/usr/ssl/cert.pem` – Nazar Hussain Aug 10 '12 at 11:47
How do you use dtruss to work out where the system is looking for the certificate? – pingu Oct 05 '13 at 13:57
@pingu can't remember the exact command basically you run druss and you tell it to run what ever ruby process you want it to "inspect". It's output is very verbose but basically you will be able to see each system call ruby is making. One of the calls will be a read file call which will be pointing to a file that does not exist. Move the cert here or create a link and you should be good to go. – Stewart Nov 05 '13 at 06:04
Ruby should not be looking for a `cacert.pem` on OS X. OS X does not use `cacert.pem`. System and user certificates are stored in the KeyChain. Ruby should be integrating with the KeyChain on OS X. – jww Dec 12 '15 at 01:31
What is the best way to do this? Can you post an example? – Stewart Dec 12 '15 at 11:12

score 19 · Answer 7 · answered Aug 26 '12 at 15:59

19

The new certified gem is designed to fix this:

https://github.com/stevegraham/certified

answered Aug 26 '12 at 15:59

Kevin

4,225
2
37
40

Works with ruby 2.0.0p481 (2014-05-08) [i386-mingw32] – Evmorov Jul 31 '14 at 18:37
1

Not working for me with Rails 4.1.9, ruby-2.1.5. I added it to the Gemfile, `bundle`, explicitly added `require "certified"` just to be sure, and nothing changes. What am I missing? – Isaac Betesh May 19 '15 at 16:51
Ruby should not be looking for a `cacert.pem` on OS X. OS X does not use `cacert.pem`. System and user certificates are stored in the KeyChain. Ruby should be integrating with the KeyChain on OS X. OpenSSL has *never* distributed a `cacert.pem`. Its not clear to me why any software would defer to OpenSSL for it. – jww Dec 12 '15 at 01:33

score 18 · Answer 8 · answered Mar 27 '16 at 02:29

18

Just add gem 'certified' in your gemfile and run bundle install.

gem 'certified'
bundle install

answered Mar 27 '16 at 02:29

Nitish Kumar

409
4
4

Confirming that this helped on El Capitan. Thanks! – mcmlxxxiii Apr 01 '16 at 05:55
It works perfectly with Rails and Debian :) big big thanks! – Szymon Rut Jul 22 '17 at 14:37

score 17 · Answer 9 · edited Jun 22 '15 at 00:53

17

On Mac OS X Lion with the latest macport:

sudo port install curl-ca-bundle  
export SSL_CERT_FILE=/opt/local/share/curl/curl-ca-bundle.crt

Then, rerun the failed job.

Note, the cert file location seems to have changed since Eric G answered on May 12.

edited Jun 22 '15 at 00:53

jww

97,681
90
411
885

answered Jan 06 '12 at 12:32

Mike Park

1,965
1
14
10

After all of the searching and a multitude of attempts, this was the only thing that solved the problem. Thanks! – shawnwall Jul 09 '12 at 03:15
1

cool, that fixed it. But as long as openssl is installed with homebrew, you have to add a ``export SSL_CERT_FILE=/usr/local/etc/openssl/cacert.pem`` to your .profile or .bashrc file – 23tux Oct 24 '12 at 15:08

score 15 · Answer 10 · edited Sep 03 '15 at 04:24

15

Here's another option for debugging purposes.

Be sure never to use this in any production environment, as it will negate benefits of using SSL in the first place. It is only ever valid to do this in your local development environment.

require 'openssl'
OpenSSL::SSL::VERIFY_PEER = OpenSSL::SSL::VERIFY_NONE

edited Sep 03 '15 at 04:24

pkaeding

36,513
30
103
141

answered May 18 '11 at 17:12

Scott

7,034
4
24
26

thanks a lot this helped me it uploading my video to youtube with the youtube_it gem – Uchenna Oct 24 '11 at 22:51
26

Downvoted: Yes, this works, but the barrier to installing a valid CA bundle and actually solving the problem is so low that a solution like this – which near-completely invalidates the security of SSL – is not a solution that should be implemented unless you're in an environment where the Certificate Authority is completely inaccessible (and even then, you should create a local CA that is accessible to both endpoints). – Ry Biesemeyer Apr 25 '12 at 17:21
11

It didn't near completely remove SSL protection, it completely removes it. Never do this. – drbrain May 07 '12 at 08:16
15

For debugging it is sufficient – rickyduck Jun 01 '12 at 10:51
1

This produces a warning now in 1.9 – Ivan -Oats- Storck Aug 06 '12 at 17:35
Don't use this solution with the excuse that it is sufficient for debugging. Take a look at this one http://stackoverflow.com/a/16983443/11792 – Pavel Nikolov Jun 07 '13 at 12:07
never ever do that, it's only stupid workaround and very often leads to problems – lisowski.r Jul 12 '13 at 12:34
You might as well just not use SSL at all. – A B Apr 10 '14 at 21:41
2

This is a bad solution for production work over the actual Internet, but it is emphatically not true that "you might as well not use SSL at all". Traffic encrypted over the wire is better than traffic in the clear. Yes, you have the possibility of man-in-the-middle attacks, but those are at least one notch harder to stand up than simply eavesdropping on the plaintext traffic as it glides by. – Mark Reed Sep 09 '14 at 16:08

Jonathan · Answer 11 · 2016-11-08T19:18:15.513

14

A one liner fixes it for Windows in an Admin prompt

choco install wget (first see chocolatey.org)

wget http://curl.haxx.se/ca/cacert.pem -O C:\cacert.pem && setx /M SSL_CERT_FILE "C:\cacert.pem"

Or just do this:

gem sources -r https://rubygems.org/
gem sources -a http://rubygems.org/

Milanio's method:

gem sources -r https://rubygems.org
gem sources -a http://rubygems.org 
gem update --system
gem sources -r http://rubygems.org
gem sources -a https://rubygems.org

gem install [NAME_OF_GEM]

edited Nov 08 '16 at 19:18

answered Feb 04 '15 at 01:48

Jonathan

6,741
7
52
69

1

Small improvement - you just need to update ruby and then you can add https source back - this just worked for me like a charm: gem sources -r https://rubygems.org/ => gem sources -a http://rubygems.org/ => gem update --system => gem sources -r http://rubygems.org/ => gem sources -a https://rubygems.org/ => gem install [NAME_OF_GEM] – milanio Nov 06 '16 at 14:49
Error fetching https://rubygems.org: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate) (https://api.rubygems.org/specs.4.8.gz) – kAmol Nov 02 '20 at 14:02

score 13 · Answer 12 · answered Apr 28 '12 at 16:55

13

Well this worked for me

rvm pkg install openssl
rvm reinstall 1.9.2 --with-openssl-dir=$rvm_path/usr

Something is wrong with openssl implementation of my ubuntu 12.04

answered Apr 28 '12 at 16:55

ramasamy

131
1
2

3

This works, but I had to finish with this : `curl -O http://curl.haxx.se/ca/cacert.pem`, `mv cacert.pem cert.pem`, `mv cert.pem $rvm_path/usr/ssl` – Raf Oct 26 '12 at 10:25
Worked for me, Mac OS X Yosemite. Thanks! – anevaude Mar 14 '15 at 22:31

Quv · Answer 13 · 2014-12-29T10:24:19.583

While knowing it's rather a lame solution, I'm still sharing this because it seems like very few people answering here use Windows, and I think some of Windows users (me included) would appreciate a simple and intuitive approach.

require 'openssl'
puts OpenSSL::X509::DEFAULT_CERT_FILE

That tells where your openssl is looking for the cert file. My name is not Luis, but mine was C:/Users/Luis/Code/luislavena/knap-build/var/knapsack/software/x86-windows/openssl/1.0.0l/ssl/cert.pem. The path may be different depending on each own environments (e.g. openknapsack instead of luislavena).

The path didn't change even after set SSL_CERT_FILE=C:\foo\bar\baz\cert.pem via the console, so... I created the directory C:\Users\Luis\Code\luislavena\knap-build\var\knapsack\software\x86-windows\openssl\1.0.0l\ssl in my local disk and put a cert file into it.

Lame as it is, this will surely work.

Brilliant. Hacky, but this was the only thing that solved my problem. — Daniel Magliola, Dec 01 '14 at 12:28
Nice way of debugging... For me the user was "Justin". Googling shows this seems to be a known issue with RubyInstaller. Unfortunately, creating that directory (+ pem file) myself, didn't solve the issue for me — Wouter, Apr 10 '17 at 09:52

score 12 · Answer 14 · edited Jul 13 '15 at 03:42

12

I've try install curl-ca-bundle with brew, but the package is no available more:

$ brew install curl-ca-bundle
Error: No available formula for curl-ca-bundle 
Searching formulae...
Searching taps...

The solution that worked to me on Mac was:

 $ cd /usr/local/etc/openssl/certs/
 $ sudo curl -O http://curl.haxx.se/ca/cacert.pem

Add this line in your ~/.bash_profile (or ~/.zshrc for zsh):

export SSL_CERT_FILE=/usr/local/etc/openssl/certs/cacert.pem

Then update your terminal:

$ source ~/.bash_profile

edited Jul 13 '15 at 03:42

Manoj Sehrawat

1,283
1
10
25

answered Jun 23 '15 at 13:03

monteirobrena

2,562
1
33
45

1

This worked for me - but the path is wrong. Should be: `export SSL_CERT_FILE=/usr/local/etc/openssl/certs/cacert.pem` – dnlmzw Jul 12 '15 at 09:40
2

This is a nice solution, because of its simplicity. Also, by referencing the added certificate in `~/.bash_profile`, it leaves a reminder of what was added (and, crucially where) when further updates are required. – auxbuss Aug 12 '15 at 17:18
This worked for me. @dnlmzw the path was fine for me but of course this depends on your setup. Thanks! – hummmingbear Jan 08 '16 at 18:55
didn't work for me when trying to add a private gem server URL that uses a self-signed certificate to my gem sources. OSX 10.11.6 + rbenv – sixty4bit Aug 17 '16 at 20:50

Henry · Answer 15 · 2016-12-19T06:31:48.920

10

I had this same issue while working on a Ruby project. I am using Windows 7 64bit.

I resolved this by:

Downloading the cacert.pem file from http://curl.haxx.se/ca/cacert.pem.
Saved that file to C:/RubyCertificates/cacert.pem
Then set my environmental variable "SSL_CERT_FILE" to "C:\RubyCertificates\cacert.pem"

source: https://gist.github.com/fnichol/867550

edited Dec 19 '16 at 06:31

answered Feb 16 '16 at 10:23

Henry

17,490
7
63
98

Since it is Windows, backslahes should be used in the value of the environment variable. – Christian Baumann Apr 12 '16 at 06:47
this is the only solution that worked to fix "bundle" for me, after fixing the rubygems ssl error – DonBecker Nov 23 '16 at 03:46

score 7 · Answer 16 · answered Oct 15 '13 at 16:57

7

The most straightforward answer which worked for me was this

sudo apt-get install openssl ca-certificates

And voila!!!

answered Oct 15 '13 at 16:57

Pratik Bothra

2,642
2
30
44

1

Wish I could up vote more than once cause you just saved me so much time! – Stephen Jun 19 '14 at 03:52
1

@Stephen - I wish you could too :-). It saved me a lot of time, so I thought I'd post it here, and it might help someone else too. – Pratik Bothra Jun 19 '14 at 09:50

score 7 · Answer 17 · answered Oct 21 '13 at 11:32

7

OS X 10.8.x with Homebrew:

brew install curl-ca-bundle
brew list curl-ca-bundle
cp /usr/local/Cellar/curl-ca-bundle/1.87/share/ca-bundle.crt /usr/local/etc/openssl/cert.pem

answered Oct 21 '13 at 11:32

Synthesis

230
3
3

1

Works for me on 10.9 as well. – Sami Samhuri Nov 13 '13 at 19:09
1

Ok for me, OS X 10.9.1. Awesome! – rogeriopradoj Dec 31 '13 at 02:27
Something is severely broken when you have to hunt down random solutions to fix these dumb problems. All of these answer do something entirely different and all of them seemed to help people at some point. WTF? – sergserg Mar 28 '14 at 15:33
13

curl-ca-bundle was revmoved from brew – Fa11enAngel Sep 11 '14 at 06:41

score 4 · Answer 18 · answered Dec 07 '12 at 18:29

4

This worked for me. If you using rvm and brew:

rvm remove 1.9.3
brew install openssl
rvm install 1.9.3 --with-openssl-dir=`brew --prefix openssl`

answered Dec 07 '12 at 18:29

Rahul

454
1
6
18

score 4 · Answer 19 · answered May 06 '15 at 17:13

I ran into this issue and the suggested fix of rvm osx-ssl-certs update all did not work despite that I am an RVM user on OSX.

The fix that worked for me was re-installing the latest version of openssl:

brew update
brew remove openssl
brew install openssl

score 4 · Answer 20 · answered Oct 03 '15 at 10:42

4

I fixed this problem by running this in terminal. Full writeup is available over here

rvm install 2.2.0 --disable-binary

answered Oct 03 '15 at 10:42

Wraithseeker

1,884
2
19
34

score 4 · Answer 21 · answered Dec 31 '10 at 07:18

4

Then, as this blog post suggests,

"How to Cure Net::HTTP’s Risky Default HTTPS Behavior"

you might want to install the always_verify_ssl_certificates gem that allow you to set a default value for ca_file.

answered Dec 31 '10 at 07:18

martoche

509
4
3

score 3 · Answer 22 · answered May 03 '13 at 06:09

3

OSX solution:

install latest rvm stable version

rvm get stable

use rvm command to solve the certificates automatically

rvm osx-ssl-certs update all

answered May 03 '13 at 06:09

Alston

1,166
2
13
26

1

I tried this and it didn't work for me. Here's my solution: http://stackoverflow.com/a/16741712/62 – Liron Yahdav May 24 '13 at 18:53
Worked for me after installing Ruby 2.0.0 via RVM. – Chris Peters Aug 17 '13 at 20:12

Tarun Rathi · Answer 23 · 2016-05-26T07:20:47.920

3

If you are running your rails app locally then just add this line at the bottom of application.rb.

OpenSSL::SSL::VERIFY_PEER = OpenSSL::SSL::VERIFY_NONE

After this you can use the app without any issues. You may call it a hack but it is not recommended. Use only when you need to run locally

edited May 26 '16 at 07:20

answered Nov 19 '15 at 12:47

Tarun Rathi

577
4
6

score 2 · Answer 24 · answered May 23 '15 at 11:18

If you have a symbolic link in the /usr/local/etc/openssl pointing to cert.pem try to do this:

ruby -ropenssl -e "p OpenSSL::X509::DEFAULT_CERT_FILE" (should be /usr/local/etc/openssl)
cd /usr/local/etc/openssl
wget http://curl.haxx.se/ca/cacert.pem
ln -s cacert.pem 77ee3751.0 (77ee3751.0 is my symbolic link, should depend on the openssl version)

score 2 · Answer 25 · answered Nov 02 '16 at 13:37

What worked for me is a combination of answers, namely:

# Reinstall OpenSSL
brew update
brew remove openssl
brew install openssl
# Download CURL CA bundle
cd /usr/local/etc/openssl/certs
wget http://curl.haxx.se/ca/cacert.pem
/usr/local/opt/openssl/bin/c_rehash
# Reinstall Ruby from source
rvm reinstall 2.2.3 --disable-binary

score 2 · Answer 26 · edited Jan 11 '12 at 18:59

2

Here's what I did that helped if you are specifically having a problem on Leopard.

My cert was old and needed to be updated. I downloaded this:

http://curl.haxx.se/ca/cacert.pem

Then replaced my cert which was found here on Leopard:

/usr/share/curl/curl-ca-bundle.crt

Reload whatever you have that's accessing it and you should be good to go!

edited Jan 11 '12 at 18:59

sra

23,820
7
55
89

answered Aug 25 '11 at 03:35

Musicalmindz

96
8

score 2 · Answer 27 · answered Mar 24 '12 at 16:59

Just because instructions were a slight bit different for what worked for me, I thought I add my 2 cents:

I'm on OS X Lion and using macports and rvm

I installed curl-ca-bundle:

sudo port install curl-ca-bundle

Then I adjusted my omniauth config to be this:

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :google_oauth2, APP_CONFIG['CONSUMER_KEY'], APP_CONFIG['CONSUMER_SECRET'],
           :scope => 'https://www.google.com/m8/feeds https://www.googleapis.com/auth/userinfo.profile',
           :ssl => {:ca_path => "/share/curl/curl-ca-bundle.crt"}
end

You could (and probably should) forgo the entire CA Zoo (`ca-bundle.crt`) and use [Google Internet Authority G2](https://pki.google.com/) in `:ssl => {:ca_path => "/share/curl/curl-ca-bundle.crt"}`. That's the only one needed to certify connections to Google. — jww, Jun 22 '15 at 00:50

score 1 · Answer 28 · edited Jun 28 '14 at 03:35

1

I had trouble for a number of days and was hacking around. This link proved out to be extremely helpful for me. It helped me to do a successful upgrade of the SSL on MAC OS X 9.

edited Jun 28 '14 at 03:35

zishe

10,665
12
64
103

answered Apr 25 '14 at 05:19

PackedUp

369
5
16

score 1 · Answer 29 · answered Mar 15 '16 at 00:13

1

Sometime it's not always rvm's problem in MAC OSX,if you remove .rvm,the problem still(espcially while you backup data from timemachine) ,you can try this way.

1.brew update
2.brew install openssl

answered Mar 15 '16 at 00:13

Albert.Qing

4,220
4
37
49

score 1 · Answer 30 · answered Mar 19 '16 at 15:07

1

Adding gem 'certified', '~> 1.0' to my Gemfile and running bundle solved this issue for me.

answered Mar 19 '16 at 15:07

user2573222

207
4
15

score 1 · Answer 31 · edited Jun 20 '16 at 00:17

1

Just run the certified-update executable and this command will make sure that all your certificates are up-to-date.

This worked for my Ruby on Rails application in Windows.

edited Jun 20 '16 at 00:17

Tim Malone

3,364
5
37
50

answered Jun 19 '16 at 21:27

Saurin Parikh

11
1

score 1 · Answer 32 · answered Oct 18 '16 at 19:17

1

The latest rubygem-update-2.6.7 has resolved this issue. http://guides.rubygems.org/ssl-certificate-update/

answered Oct 18 '16 at 19:17

singh2005

1,251
12
19

score 1 · Answer 33 · answered Feb 22 '18 at 17:07

1

Having this issue with Ruby 2.3.4:

I solved it uninstalling OpenSSL and reinstalling it. I ran:

brew uninstall --ignore-dependencies openssl

then

brew install openssl

It did the job.

answered Feb 22 '18 at 17:07

Uj Corb

1,959
4
29
56

score 0 · Answer 34 · edited Jun 22 '15 at 00:55

0

This can be the issue of the broken/invalid SSL certificates. On mac you can use this command to update the SSL certificates:

rvm osx-ssl-certs update all

edited Jun 22 '15 at 00:55

jww

97,681
90
411
885

answered Dec 03 '14 at 12:58

abcd_win

107
1
6

score 0 · Answer 35 · answered Mar 22 '16 at 12:36

0

Installing the following package on Ubuntu fixed the issue for me

sudo apt-get install libssl-dev

answered Mar 22 '16 at 12:36

bruckerrlb

185
2
7

score 0 · Answer 36 · answered Jun 21 '16 at 07:52

I had to reinstall Ruby. This should solve it if you are using Ubuntu & rbenv:

rbenv uninstall your_version

# install dependencies
sudo apt-get install autoconf bison build-essential libssl-dev libyaml-dev libreadline6-dev zlib1g-dev libncurses5-dev libffi-dev libgdbm3 libgdbm-dev

# install ruby with patch
curl -fsSL https://gist.github.com/mislav/055441129184a1512bb5.txt | \
  rbenv install --patch your_version

For more information, check out the rbenv Wiki on the matter.

score -1 · Answer 37 · answered May 25 '16 at 23:15

-1

Add this to your gemfile:

gem 'cliver', :git => 'git://github.com/yaauie/cliver', :ref => '5617ce'

answered May 25 '16 at 23:15

Jesse Farmer

553
4
13

SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed

37 Answers37

Update

The Manual Way (Boring)

Linked

Related