state=error: certificate verify failed (self-signed certificate in certificate chain)

The full message is "SSL_connect returned=1 errno=0 peeraddr=<ip>:<port> state=error: certificate verify failed (self-signed certificate in certificate chain)". OpenSSL 1.1.1-based Rubies print "self signed" without the hyphen.

Ruby openssl (Net::HTTP, Faraday, RubyGems) — OpenSSL::SSL::SSLError from SSL_connect

What it means

The server's chain ends in a self-signed root certificate that Ruby's OpenSSL does not trust. With public hosts such as rubygems.org this means a TLS-inspecting proxy or antivirus is re-signing the connection; with internal hosts, the company root is missing from the store Ruby uses.

Why it happens

• A TLS-inspecting proxy

  common

  Corporate proxies re-sign rubygems.org, GitHub and APIs with their own root; Ruby's OpenSSL store lacks it.

• An internal service with a private root in its chain

  common

  The root is sent by the server but not installed on the client.

• Ruby uses a different bundle than the system

  occasional

  Rubies installed with rbenv/asdf against Homebrew OpenSSL or RubyInstaller on Windows use their own CA bundle.

How to fix it

1. 1.

   Identify the root

   Print the chain for a public host; a root named after your company or a security vendor is the one to trust.

   openssl s_client -connect rubygems.org:443 -servername rubygems.org -showcerts </dev/null 2>/dev/null \
     | grep -E '^ *[0-9]+ s:|^ *i:'

2. 2.

   Point SSL_CERT_FILE at a combined bundle

   Combine the public roots with the proxy root, because SSL_CERT_FILE replaces the default bundle.

   # Public roots + the proxy root in one bundle
   cat /etc/ssl/certs/ca-certificates.crt corp-proxy-root.pem > ~/.config/corp-ca-bundle.pem
   export SSL_CERT_FILE=~/.config/corp-ca-bundle.pem

3. 3.

   Install the root system-wide (Linux)

   Rubies linked against the system OpenSSL pick it up after update-ca-certificates.

   sudo cp corp-proxy-root.pem /usr/local/share/ca-certificates/corp-proxy-root.crt && sudo update-ca-certificates

← Browse the full signature error database