Ruby OpenSSL::SSL::SSLError

Question

I'm analyzing cryptocurrency market data and using public API of certain exchanges. The program makes HTTPS requests every some seconds. Strangely enough it makes exactly 336 requests and on 337 request it always failed with:

/.rbenv/versions/2.4.5/lib/ruby/2.4.0/net/protocol.rb:44:in `connect_nonblock': SSL_connect SYSCALL returned=5 errno=0 state=error: certificate verify failed (OpenSSL::SSL::SSLError)

I've tried various delays between requests (1 second, 5, 10 seconds), various different exchanges (Bittrex, Poloniex, Tradeogre), various versions of Ruby (2.3.8, 2.4.5, 2.5.3) and various Linux distributions (Ubuntu 18.04.2 LTS, Debian 9.8) on various hostings (Google Compute Engine, Amazon EC2). It's always the same - it fails on the iteration #337. On my local machine (Ruby 2.5.3, Linux Mint 18.3) the program works without such problems, it fails only while running on server. Have no idea what the problem is and how to fix. Thanks in advice.

From a openssl point of view "certificate verify failed" means that the openssl can't verify the server certificate returned from the server. This normally means one fo the following: 1. the root certificate is NOT in calist setup for your client machine. or 2. a intermediate certificate is missing in the server certificate (this is a server problem). Without determining which server connection is the problem it's hard to suggest anything about this problem. — Shane Powell, Mar 10 '19 at 22:41
Please show the relevant code and state the exact error. Also show the failed certificate. Also see [How to create a Minimal, Complete, and Verifiable example](http://stackoverflow.com/help/mcve). — jww, Mar 11 '19 at 03:15

score 0 · Answer 1 · answered Mar 11 '19 at 14:43

Ideas:

Disable server cert verification (this is insecure): open(request_uri, { ssl_verify_mode: OpenSSL::SSL::VERIFY_NONE }) (see https://stackoverflow.com/a/19172281/384689)
Try different CA (certificate authority) store. For example, you could download the one being used by Firefox: https://curl.haxx.se/docs/caextract.html and pass it as cert_store parameter to start() method

Ruby OpenSSL::SSL::SSLError

1 Answers1