Could not verify the SSL certificate for https://gems.example.com/.

Bundler prints "Retrying fetcher due to error (n/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for <source>." for each attempt, followed by "There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification." The source URL is the one from your Gemfile.

Bundler — Bundler::Fetcher::CertificateFailureError while fetching a gem source

What it means

Bundler could not verify the TLS certificate of a gem source in the Gemfile, retried, and gave up. It wraps the OpenSSL verification error in Bundler::Fetcher::CertificateFailureError and adds a hint that the system may lack CA certificates. As with Ruby generally, the trusted CAs are those of the OpenSSL bundle this Ruby uses, unless Bundler's ssl_ca_cert setting says otherwise.

Why it happens

• A private gem server with a company certificate

  common

  Gemfury, Artifactory, Nexus or a self-hosted gem server whose CA is not in the bundle Ruby uses (common in CI images).

• A TLS-inspecting proxy in front of rubygems.org

  common

  The proxy's root is trusted by browsers through the OS store but not by Ruby's OpenSSL bundle.

• This Ruby uses its own CA bundle

  occasional

  Rubies built against Homebrew or bundled OpenSSL, and RubyInstaller on Windows, do not read the OS certificate store.

How to fix it

1. 1.

   Set Bundler's ssl_ca_cert

   bundle config set ssl_ca_cert points Bundler at a CA file for its fetches. In our test this resolved the error immediately.

   # Trust a CA for Bundler (stored in .bundle/config; --global for ~/.bundle/config)
   bundle config set --local ssl_ca_cert /etc/ssl/private-ca/corp-root-ca.pem
   bundle install

2. 2.

   Or set SSL_CERT_FILE

   OpenSSL's environment variable applies to Bundler, RubyGems and the application alike; point it at a bundle that also contains the public roots.

   # Or for the whole process (Bundler, RubyGems and Net::HTTP)
   SSL_CERT_FILE=/etc/ssl/private-ca/corp-ca-bundle.pem bundle install

3. 3.

   Install the CA in the store Ruby reads

   Check OpenSSL::X509::DEFAULT_CERT_FILE to see which bundle that is, and add the root there (on Debian and Ubuntu through update-ca-certificates).

   sudo cp corp-root-ca.pem /usr/local/share/ca-certificates/corp-root-ca.crt && sudo update-ca-certificates
   ruby -ropenssl -e 'p OpenSSL::X509::DEFAULT_CERT_FILE'   # the bundle this Ruby reads

4. 4.

   RubyGems: :ssl_ca_cert in .gemrc

   gem install has its own setting with the same purpose.

   # ~/.gemrc — the same CA for "gem install"
   :ssl_ca_cert: /etc/ssl/private-ca/corp-root-ca.pem

← Browse the full signature error database