"Certificate verify failed" OpenSSL error when using Ruby 1.9.3

Question

I'm using Ruby 1.9.3p0 on Mac OS 10.6.8 (installed using rvm). When I attempt to create a new Rails application using an application template hosted on GitHub, with this (for example):

$ rails new myapp -m https://github.com/RailsApps/rails3-application-templates/raw/master/rails3-mongoid-devise-template.rb -T -O

I get this error message:

/Users/me/.rvm/rubies/ruby-1.9.3-p0/lib/ruby/1.9.1/net/http.rb:799:in `connect': SSL_connect 
returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed 
(OpenSSL::SSL::SSLError)

I understand the Ruby language interpreter is using OpenSSL to connect to GitHub to request the application template file. GitHub requires all connections to be made using SSL. The connection failed because OpenSSL was unable to verify the server certificate.

I was able to resolve the issue by downloading a certificates file:

$ cd /opt/local/etc/openssl
$ sudo curl -O http://curl.haxx.se/ca/cacert.pem
$ sudo mv cacert.pem cert.pem

I had no problem using Ruby 1.9.2. Why did I get the "certificate verify failed" problem for Ruby 1.9.3? Is this a Ruby 1.9.3 bug? Is it specific to Mac OS 10.6.8? Is my solution the right way to resolve this?

Solution 1

There are lots of moving parts involved in the correct answer. Depends on your OS, Ruby version, OpenSSL version, Rubygems version. I ended up writing an article after researching it. My article explains the reasons for the error, offers steps for further diagnosis, shows several workarounds, and suggests possible solutions. This will be helpful:

OpenSSL Errors and Rails – Certificate Verify Failed

There are also links to the relevant commits and issues on GitHub.

Solution 2

For me this occurred on OS X with homebrew after updating to the latest RVM (rvm 1.20.12) and then installing ruby-1.9.3-p429. I could reproduce the issue simply by running:

$ rvm use ruby-1.9.3-p429
$ irb
1.9.3p429 :001 > require 'open-uri'; open 'https://google.com'
OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/net/http.rb:800:in `connect'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/net/http.rb:800:in `block in connect'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/timeout.rb:55:in `timeout'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/timeout.rb:100:in `timeout'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/net/http.rb:800:in `connect'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/net/http.rb:756:in `do_start'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/net/http.rb:745:in `start'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/open-uri.rb:306:in `open_http'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/open-uri.rb:775:in `buffer_open'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/open-uri.rb:203:in `block in open_loop'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/open-uri.rb:201:in `catch'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/open-uri.rb:201:in `open_loop'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/open-uri.rb:146:in `open_uri'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/open-uri.rb:677:in `open'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/open-uri.rb:33:in `open'
    from (irb):1
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/bin/irb:16:in `<main>'1.9.3p429 :002 > 

The solution was similar to that in the question, but the path was wrong. Running this fixed it:

curl https://curl.haxx.se/ca/cacert.pem -o /usr/local/etc/openssl/cert.pem

The clue as to the correct path was that when I was installing ruby-1.9.3-p429 via RVM this showed in the output:

Certificates in '/usr/local/etc/openssl/cert.pem' already are up to date.

I had the /usr/local/etc/openssl path, but no cert.pem file in that directory, so I'm not sure why RVM claimed the certificates were up to date. It would be nice to know why I had to do this in first place, but I don't have time to investigate now.

Solution 3

I had the same problem, having compiled my RVM Ruby against an RVM install of OpenSSL. I moved the cacerts.pem file as downloaded by the original poster under ~/.rvm/usr/ssl/cert.pem to make the problem go away.

Solution 4

I was having the same problem.

The way I finally fixed it was by upgrading my version of OpenSSL I had installed through MacPorts. I was running a version of OpenSSL from 2009 so I have upgraded my MacPorts installation then upgraded my OpenSSL installtion via the ports command line interface and the error disappeared.

There must be some integration between Ruby/Rails and OpenSSL on Mac based installations that goes without saying. In my case I was having problems getting the Login with Facebook to work properly when Facebook was sending the oAuth/Login token back to my app, Devise & OmniAuth must have needed a valid SSL cert for graph.facebook.com which wasn't in my old version of OpenSSL.

Solution 5

Openssl certification directory is /usr/lib/ssl/ in Debian. So, following three lines was enough for me,

$ cd /usr/lib/ssl/
$ sudo curl -O http://curl.haxx.se/ca/cacert.pem
$ sudo mv cacert.pem cert.pem

View more solutions

Comments

[Daniel Kehoe]

I used rvm to install both Ruby 1.9.2 and 1.9.3.

[Daniel Kehoe]

Thanks! The best thing may be to use rvm to install a fresh copy of openssl as described here: beginrescueend.com/packages/openssl.

[Wukerplank]

Thank you man, I tried all the shenanigans, but your tip solved it!

[Rob]

This almost worked for me, but I had to put cacerts.pem file at /usr/local/etc/openssl/cert.pem. Here's the details of my problem and solution: stackoverflow.com/a/16741712/62

[Eben Geer]

curl http://curl.haxx.se/ca/cacert.pem -o /usr/local/etc/openssl/cert.pem exactly what I needed. thanks

[Rob]

Note this was actually a bug with RVM: github.com/wayneeseguin/rvm/issues/1920. It's been fixed since.

[Blue Smith]

Thank you a lot! I'm using Ruby 1.8.7-p370 and had to run this: curl http://curl.haxx.se/ca/cacert.pem -o /etc/ssl/certs/ca-certificates.crt to solve the problem. Your tip is great!

[JoeyC]

I didn't have a cert.pem, so I created one under ~/.rvm/usr/ssl and copy and cert.pem from curl.haxx.se. Unfortunately, am still getting the same Faraday issue: Certificate Verify Failed. Am using Ruby 1.9.3 and koala version 1.6.0 (not sure if that is relevant though).

[JoeyC]

If you are on windows, click through to the solution for Windows and don't forget to set the SSL_CERT environment variable and close and reopen the terminal. So good to finally get a resolution!