265

When I run bundle install for my Rails 3 project on Centos 5.5 it fails with an error:

Gem::RemoteFetcher::FetchError: SSL_connect returned=1 errno=0 state=SSLv3 
read server certificate B: certificate verify failed 
(https://bb-m.rubygems.org/gems/multi_json-1.3.2.gem)
An error occured while installing multi_json (1.3.2), and Bundler cannot continue.
Make sure that `gem install multi_json -v '1.3.2'` succeeds before bundling.

When I try to install the gem manually (by gem install multi_json -v '1.3.2') it works. The same problem occurs with several other gems. I use RVM (1.12.3), ruby 1.9.2, bundler 1.1.3.

How to fix it?

4
  • Facing the same problem. But with another gem: Gem::RemoteFetcher::FetchError: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed (bb-m.rubygems.org/gems/activeresource-3.2.3.gem)
    – Sathish
    Apr 20, 2012 at 16:31
  • 4
    I am having the same error with the same circumstances. I suspect, given these other responses, that it's a server-side issue.
    – asfallows
    Apr 20, 2012 at 16:47
  • I had a similar problem in Rails 5. Fixed it by adding source "https://rubygems.org'' in the Gemfile and running 'gem update --system'. You can find more info here. Mar 9, 2018 at 15:25
  • Nesha, that fix worked for me. Thank you! Aug 15, 2018 at 18:22

28 Answers 28

313

Update

Now that I've karma wh..err mined enough from this answer everyone should know that this should have been fixed.

re: via Ownatik again bundle install fails with SSL certificate verification error

gem update --system

My answer is still correct and left below for reference if that ends up not working for you.


Honestly the best temporary solution is to

[...] use the non-ssl version of rubygems in your gemfile as a temporary workaround.

via user Ownatik

what they mean is at the top of the Gemfile in your rails application directory change

source 'https://rubygems.org'

to

source 'http://rubygems.org'

note that the second version is http instead of https

17
  • 1
    I'm accepting this answer, because that was the thing that I did at first. Later I changed my deploy strategy. Now I run bundle the application on another server and then I copy it (with gems in vendor directory) to the server I wrote about in the question.
    – mrzasa
    May 2, 2012 at 6:48
  • 7
    This didn't work for me. The link provided by @fbernier below fixed it for me. Oct 1, 2013 at 20:10
  • 5
    This doesn't work. Running this just provides output of Latest version currently installed. Aborting. Any other ideas? Nov 3, 2013 at 22:49
  • 1
    In terms of changing the source, for newer people like me. I would specify that this file is located in your application directory. I was looking for it in the railsinstaller directory. Anyways, I changed the source and it finally worked. I am getting certificate errors when I try to run the update :(
    – Brian
    Jan 14, 2014 at 21:16
  • 3
    gem update --system fails with the exact same certificate error :\ Dec 16, 2014 at 16:23
228

Replace the ssl gem source with non-ssl as a temp solution:

10
  • 8
    OMG worked like a charm! I'm on Windows 7 x64 behind a corporate proxy. Thanks a lot! Sep 27, 2013 at 9:39
  • 15
    I'm surprised this was not ranked higher, this was the easiest quick fix.
    – hwatkins
    Oct 1, 2013 at 19:41
  • 3
    good temp solution...be aware of the following :: RubyGems has been configured to serve gems via the following URLs through its history: * gems.rubyforge.org (RubyGems 1.3.6 and earlier) * rubygems.org (RubyGems 1.3.7 through 1.8.25) * rubygems.org (RubyGems 2.0.1 and newer)
    – beauXjames
    Oct 9, 2013 at 18:46
  • 1
    fastest solution for me on Windows 8
    – Tisch
    Dec 14, 2014 at 1:05
  • 4
    Imho this should not even be considered a valid answer, because it opens up your system to attacks from outside.
    – rubiii
    Jan 31, 2017 at 22:03
163

The reason is old rubygems. You need to update system part using non ssl source first:

gem update --system --source http://rubygems.org/ (temporarily updating system part using non-ssl connection).

Now you're ready to use gem update.

9
  • 5
    Really simple solution that's cross-platform and allows RubyGems to take care of the details. Nice.
    – zrisher
    Dec 19, 2014 at 2:53
  • 2
    this was the one that should be accepted, the answers above don't explain that you need to remove the ssl sources first
    – Ephraim
    Feb 11, 2015 at 20:54
  • 1
    Thanks - this is the ticket. If you get a "not in cache" message when adding or removing sources, try it with or without a trailing slash. It has to match exactly. Mar 25, 2015 at 23:17
  • 1
    I have searched trough many solutions. This is the one worked like a charm. Thank you! This should be choosen as the true solution. Sep 10, 2015 at 13:49
  • 1
    Thank you!! I agree with others that this should be the accepted answer, as it doesn't result in you fetching gems through plain HTTP.
    – Alexander
    Oct 24, 2015 at 16:19
118

If you're on a mac and use a recent version of RVM (~1.20), the following command worked for me.

rvm osx-ssl-certs update
4
  • Thank you! Worked for me on Mac OSX 10.8.5 Oct 3, 2013 at 14:41
  • Thanks, worked for me too. I was trying to install CocoaPods. rvm 1.22.15, OS X 10.8.5 Oct 3, 2013 at 19:37
  • 1
    This is also pointed to in the error message "...see bit.ly/ruby-ssl".
    – IAmNaN
    Oct 4, 2013 at 18:10
  • Thankssssss!! Worked for me!! \o/ May 7, 2015 at 20:29
55

This issue should now be fixed. Update rubygems (gem update --system), make sure openssl is at the latest version on your OS, or try these tips of it's still not working: http://railsapps.github.com/openssl-certificate-verify-failed.html

3
  • 1
    Needed to update bundler as well to make it work (rubygems 2.0.3 + bundler 1.3.2 + cygwin openssl 1.0.1e works for me on winxp).
    – fakeleft
    Mar 12, 2013 at 14:48
  • I had to update from 1.3.0, now I am on 1.3.4 and the https is no longer throwing the error: bundler-1.3.0/lib/bundler/vendor/net/http/persistent/ssl_reuse.rb:70:in `connect': SSL_connect returned=1 errno=0 state=SSLv3 read server key exchange B: bad ecpoint (OpenSSL::SSL::SSLError)
    – Jon Kern
    Apr 3, 2013 at 2:50
  • 3
    It is not possible to update rubygems if the SSL certificate is not accepted! Running in circles here ;)
    – kap
    Jan 15, 2015 at 21:28
53

Temporary solution (as alluded to by Ownatik):

Create or modify a file called .gemrc in your home path, including the line :ssl_verify_mode: 0

This will prevent bundler from checking the SSL certificates of gems when it attempts to install them.

For *nix devices, 'home path' means ~/.gemrc. You can also create /etc/gemrc if you prefer. For Windows XP, 'home path' means c:\Documents and Settings\All Users\Application Data\gemrc. For Windows 7, C:\ProgramData\gemrc

6
  • 3
    %USERPROFILE%\.gemrc is also searched by gem on Windows. Dec 2, 2012 at 12:54
  • 1
    Recommended file location for Windows 8? Feb 18, 2013 at 20:32
  • 6
    Removing ssl verification is temporary workaround that opens a security hole. Read more here: github.com/rubygems/rubygems/commit/…
    – mrm
    Mar 3, 2013 at 4:45
  • This is useful in my case; behind a corporate firewall that restricts all compressed files but allows them via https. Jul 10, 2013 at 8:07
  • Didn't try this solution, but in my case also worked when I added this content to the ~/.gemrc : :sources: - http://rubygems.org
    – Artur K.
    Dec 8, 2014 at 13:58
18

On windows7 you can download the cacert.pem file from here and set the environementvariable SSL_CERT_FILE to the path where you store the certificate eg

SET SSL_CERT_FILE="C:\users\<username>\cacert.pem"

or you can set the variable in your script like this ENV['SSL_CERT_FILE']="C:/users/<username>/cacert.pem"

Replace <username> with you own username.

2
15

The real solution to this problem, if you are using RVM:

  1. Update rubygems: gem update --system
  2. Use RVM to refresh SSL certs: rvm osx-ssl-certs update all

Hat tip to this tip on the RailsApps project!

1
  • 1
    rvm osx-ssl-certs update all worked fine for me. Didnt need to to do step 1.
    – DMH
    Jul 24, 2015 at 14:02
9

You can download a list of CA certificates from curl's website at http://curl.haxx.se/ca/cacert.pem

Then set the SSL_CERT_FILE environment variable to tell Ruby to use it. For example, in Linux:

$ SSL_CERT_FILE=~/cacert.pem bundle install

(Reference: https://gist.github.com/fnichol/867550)

1
  • On Debian Buster I had to do this: SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt gem update --system
    – nitrogen
    Mar 8, 2021 at 2:44
7

For those of you that have ruby installed through RVM and want a quick fix (preferring not to read per Bruno's request) just try this:

rvm remove 1.9.x (or whatever version of ruby you are using)
rvm pkg install openssl
rvm install 1.9.2 --with-openssl-dir=$rvm_path/usr

For a more details, here is the link where I found the solution.

http://railsapps.github.com/openssl-certificate-verify-failed.html

BTW, I didn't have to touch my certificates on Ubuntu.

Best of all, this isn't a workaround. It will download gems through SSL and fail if there if there is a problem like a man in the middle attack which is much better than just turning off security.

4
  • The page you link to has a "workaround" (first) and then proper solutions. It would be better if your answer stated that a bit more clearly. Nevertheless, using CA certificates (via cacert.pem or $rvm_path/usr/ssl) is indeed the right way to go.
    – Bruno
    Apr 27, 2012 at 19:43
  • 1
    Bruno, the solution will probably be a bit different depending on what flavor of Unix the person uses. It looks like reading the link will be necessary. Apr 28, 2012 at 12:19
  • I was just talking about the difference between the "workaround" on the page (:ssl_verify_mode: 0, which open problems), as opposed to any of the 3 solutions below it, which are the right way to fix this problem.
    – Bruno
    Apr 28, 2012 at 12:30
  • @Bruno, I've revised my article, please add comments or edit the wiki if you see possibilities for improvements. Apr 29, 2012 at 1:16
6

This has been fixed

http://guides.rubygems.org/ssl-certificate-update/

Now that RubyGems 2.6.x has been released, you can manually update to this version.

Download https://rubygems.org/downloads/rubygems-update-2.6.7.gem

Please download the file in a directory that you can later point to (eg. the root of your harddrive C:)

Now, using your Command Prompt:

C:\>gem install --local C:\rubygems-update-2.6.7.gem
C:\>update_rubygems --no-ri --no-rdoc

After this, gem --version should report the new update version.

You can now safely uninstall rubygems-update gem:

C:\>gem uninstall rubygems-update -x
0
5

Simple copy paste instruction given here about .pem file

https://gist.github.com/luislavena/f064211759ee0f806c88

For certificate verification failed

If you've read the previous sections, you will know what this means (and shame > on you if you have not).

We need to download AddTrustExternalCARoot-2048.pem. Open a Command Prompt and type in:

C:>gem which rubygems C:/Ruby21/lib/ruby/2.1.0/rubygems.rb Now, let's locate that directory. From within the same window, enter the path part up to the file extension, but using backslashes instead:

C:>start C:\Ruby21\lib\ruby\2.1.0\rubygems This will open a Explorer window inside the directory we indicated.

Step 3: Copy new trust certificate

Now, locate ssl_certs directory and copy the .pem file we obtained from previous step inside.

It will be listed with other files like GeoTrustGlobalCA.pem.

4

same problem but with different gem here:

Gem::RemoteFetcher::FetchError: SSL_connect returned=1 errno=0 state=SSLv3 
read server certificate B: certificate verify failed 
(https://bb-m.rubygems.org/gems/builder-3.0.0.gem)
An error occured while installing builder (3.0.0), and Bundler cannot continue.
Make sure that `gem install builder -v '3.0.0'` succeeds before bundling.

temporarily solution: gem install builder -v '3.0.0' makes it possible to continue bundle install

3
  • 7
    You can also use the non-ssl version of rubygems in your gemfile as a temporary workaround.
    – fbernier
    Apr 20, 2012 at 12:38
  • 1
    I did it and it works. For now, that's a sufficient solution.
    – mrzasa
    Apr 20, 2012 at 13:29
  • I have a same problem over here. So @Ownatik how to use ssl version of rubygems?
    – Zeck
    Apr 20, 2012 at 13:47
4

The simplest solution:

rvm pkg install openssl
rvm reinstall all --force

Voila!

3
  • 2
    What does this actually do to my system? Mar 10, 2015 at 1:12
  • rvm pkg is deprecated now, anyway.
    – labyrinth
    Dec 1, 2021 at 16:01
  • @labyrinth it gives a warning but still works May 16, 2022 at 20:48
4

This is How you fix this problem on Windows:

download .perm file then set the SSL_CERT_FILE in command prompt

https://gist.github.com/fnichol/867550

4

My permanent fix for Windows:

  1. Download the CACert , save as C:\ruby\ssl_certs\GlobalSignRootCA.pem from http://guides.rubygems.org/ssl-certificate-update/

  2. Create system variable named "SSL_CERT_FILE", set to C:\ruby\ssl_certs\GlobalSignRootCA.pem.

  3. Try again: gem install bundler:

C:\gem sources
*** CURRENT SOURCES ***
https://rubygems.org/

C:\gem install bundler
Fetching: bundler-1.13.5.gem (100%)
Successfully installed bundler-1.13.5
1 gem installed
3

I get a slightly different error, though perhaps related, on Ubuntu 12.04:

Gem::RemoteFetcher::FetchError: SSL_connect returned=1 errno=0 state=unknown state: sslv3 alert handshake failure (https://d2chzxaqi4y7f8.cloudfront.net/gems/activesupport-3.2.3.gem)
An error occured while installing activesupport (3.2.3), and Bundler cannot continue.
Make sure that `gem install activesupport -v '3.2.3'` succeeds before bundling.

It happens when I run bundle install with source 'https://rubygems.org' in a Gemfile.

This is an issue with OpenSSL on Ubuntu 12.04. See Rubygems issue #319.

To fix this, run apt-get update && apt-get upgrade on Ubuntu 12.04 to upgrade your OpenSSL.

3

I was able to track this down to the fact that the binaries that rvm downloads do not play nice with OS X's OpenSSL, which is old and is no longer used by the OS.

The solution for me was to force compilation when installing Ruby via rvm:

rvm reinstall --disable-binary 2.2
1
  • This worked for me. You need to replace "2.2" w/ the ruby version you're using
    – Josh
    Dec 20, 2016 at 0:37
3

Thx to @Alexander.Iljushkin for:

gem update --system --source http://rubygems.org/

After that bundler still failed and the solution to that was:

gem install bundler

2

I was getting a similar error. Here is how I solved this: In your path directory, check for Gemfile. Edit the source in the gemfile to http instead of https and save it. This might install the bundler without the SSL certificate issue.l

2

For Windows machine, check your gem version with

gem --version

Then update your gem as follow:

Please download the file in a directory that you can later point to (eg. the root of your hard drive C:)

Now, using your Command Prompt:

C:\>gem install --local C:\rubygems-update-1.8.30.gem
C:\>update_rubygems --no-ri --no-rdoc

Now, bundle install will success without SSL certificate verification error.

More detailed instruction is here

1

This worked for me:

  • download latest gem at https://rubygems.org/pages/download
  • install the gem with gem install --local [path to downloaded gem file]
  • update the gems with update_rubygems
  • check that you're on the latest gem version with gem --version
1

I had to reinstall openssl:

brew uninstall --force openssl
brew install openssl
1

I was just recently faced with this issue and followed the steps outlined here. There might be a chance that you are not pointing to the right OpenSSL certificate. After running:

rvm osx-ssl-certs status all
rvm osx-ssl-certs update all

and

export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt

the bundle complete ran!

1

Download rubygems-update-2.6.7.gem .

Now, using your Command Prompt:

C:\>gem install --local C:\rubygems-update-2.6.7.gem
C:\>update_rubygems --no-ri --no-rdoc

After this, gem --version should report the new update version.

You can now safely uninstall rubygems-update gem:

C:\>gem uninstall rubygems-update -x
Removing update_rubygems
Successfully uninstalled rubygems-update-2.6.7
0
1

To note, if you're grabbing gems from a source which SSL cert is trusted by an internal certificate authority (or you are connecting to an external source through a company web proxy with SSL inspection), point your SSL_CERT_FILE env variable to your certificate chain. This most likely just requires exporting your root certificate from your certificate store (System Keychain on macOS) to an accessible location from your shell i.e.:

export SSL_CERT_FILE=~/RootCert.pem
1

If you're using rails-assets

If you were using https://rails-assets.org/ to manage your assets, no answers will help you. Even converting to http won't help.

The simplest fix is using this source instead, http://insecure.rails-assets.org. This has been mentioned in their homepage.

0

The only thing that worked for me on legacy windows system and ruby 1.9 version is downloading cacert file from http://guides.rubygems.org/ssl-certificate-update/

And then running below command before running bundle install

bundle config --global ssl_ca_cert /path/to/file.pem

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.