Ruby-on-rails SSL_connect 返回=1 errno=0 state=SSLv3 读取服务器证书B：证书验证失败

SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed

提问by Vikash

I am using Authlogic-Connectfor third party logins. After running appropriate migrations, Twitter/Google/yahoo logins seem to work fine but the facebook login throws exception:

我正在使用Authlogic-Connect进行第三方登录。运行适当的迁移后，Twitter/Google/yahoo 登录似乎工作正常，但 facebook 登录引发异常：

SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed

The dev log shows

开发日志显示

OpenSSL::SSL::SSLError (SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed):
  app/controllers/users_controller.rb:37:in `update'

Please suggest..

请建议..

回答by Erik G.

I ran into a similar problem when trying to use the JQuery generator for Rails 3

我在尝试使用 Rails 3 的 JQuery 生成器时遇到了类似的问题

I solved it like this:

我是这样解决的：

1. Get the CURL Certificate Authority (CA) bundle.You can do this with:

   • sudo port install curl-ca-bundle[if you are using MacPorts]
   • or just pull it down directly wget http://curl.haxx.se/ca/cacert.pem

2. Execute the ruby code that is trying to verify the SSL certification: SSL_CERT_FILE=/opt/local/etc/certs/cacert.pem rails generate jquery:install. In your case, you want to either set this as an environment variable somewhere the server picks it up or add something like ENV['SSL_CERT_FILE'] = /path/to/your/new/cacert.pemin your environment.rb file.

1. 获取 CURL 证书颁发机构 (CA) 包。你可以这样做：

   • sudo port install curl-ca-bundle[如果您使用的是 MacPorts]
   • 或者直接拉下来 wget http://curl.haxx.se/ca/cacert.pem

2. 执行试图验证 SSL 证书的 ruby​​ 代码：SSL_CERT_FILE=/opt/local/etc/certs/cacert.pem rails generate jquery:install. 在您的情况下，您希望将其设置为服务器获取它的某个位置的环境变量，或者ENV['SSL_CERT_FILE'] = /path/to/your/new/cacert.pem在您的 environment.rb 文件中添加类似的内容。

You can also just install the CA files (I haven't tried this) to the OS -- there are lengthy instructions here-- this should work in a similar fashion, but I have not tried this personally.

你也可以在CA文件（我没有试过）安装到操作系统-有冗长的说明在这里-这应该以类似的方式工作，但我还没有尝试过这种个人。

Basically, the issue you are hitting is that some web service is responding with a certificate signed against a CA that OpenSSL cannot verify.

基本上，您遇到的问题是某些 Web 服务正在使用针对 OpenSSL 无法验证的 CA 签名的证书进行响应。

回答by htanata

If you're using RVM on OS X, you probably need to run this:

如果你在 OS X 上使用 RVM，你可能需要运行这个：

rvm osx-ssl-certs update all

More information here: http://rvm.io/support/fixing-broken-ssl-certificates

更多信息：http: //rvm.io/support/fixing-broken-ssl-certificates

And here is the full explanation: https://github.com/wayneeseguin/rvm/blob/master/help/osx-ssl-certs.md

这是完整的解释：https: //github.com/wayneeseguin/rvm/blob/master/help/osx-ssl-certs.md

---

---

Update

更新

On Ruby 2.2, you may have to reinstall Ruby from source to fix this. Here's how (replace 2.2.3with your Ruby version):

在 Ruby 2.2 上，您可能必须从源代码重新安装 Ruby 才能解决此问题。方法如下（替换2.2.3为您的 Ruby 版本）：

rvm reinstall 2.2.3 --disable-binary

Credit to https://stackoverflow.com/a/32363597/4353and Ian Connor.

归功于https://stackoverflow.com/a/32363597/4353和Ian Connor。

回答by ryanjones

Here's how you can fix it on Windows: https://gist.github.com/867550(created by Fletcher Nichol)

以下是在 Windows 上修复它的方法：https: //gist.github.com/867550（由 Fletcher Nichol 创建）

Excerpt:

摘抄：

The Manual Way (Boring)

Download the cacert.pemfile from http://curl.haxx.se/ca/cacert.pem. Save this file to C:\RailsInstaller\cacert.pem.

Now make ruby aware of your certificate authority bundle by setting SSL_CERT_FILE. To set this in your current command prompt session, type:

set SSL_CERT_FILE=C:\RailsInstaller\cacert.pem

To make this a permanent setting, add this in your control panel.

手动方式（无聊）

cacert.pem从http://curl.haxx.se/ca/cacert.pem下载文件。将此文件保存到C:\RailsInstaller\cacert.pem.

现在通过设置SSL_CERT_FILE. 要在当前的命令提示符会话中进行设置，请键入：

set SSL_CERT_FILE=C:\RailsInstaller\cacert.pem

要使其成为永久设置，请将其添加到您的控制面板中。

回答by martoche

Ruby can't find any root certificates to trust.

Ruby 找不到任何可信任的根证书。

Take a look at this blog post for a solution: "Ruby 1.9 and the SSL error".

请查看此博客文章以获取解决方案：“ Ruby 1.9 和 SSL 错误”。

The solution is to install the curl-ca-bundleport which contains the same root certificates used by Firefox:

sudo port install curl-ca-bundle

and tell your httpsobject to use it:

https.ca_file = '/opt/local/share/curl/curl-ca-bundle.crt'

Note that if you want your code to run on Ubuntu, you need to set the ca_pathattribute instead, with the default certificates location /etc/ssl/certs.

解决方案是安装curl-ca-bundle包含 Firefox 使用的相同根证书的端口：

sudo port install curl-ca-bundle

并告诉您的https对象使用它：

https.ca_file = '/opt/local/share/curl/curl-ca-bundle.crt'

请注意，如果您希望代码在 Ubuntu 上运行，则需要ca_path使用默认证书 location来设置属性/etc/ssl/certs。

回答by paulmorar

The reason that you get this error on OSX is the rvm-installed ruby.

在 OSX 上出现此错误的原因是 rvm 安装的 ruby​​。

If you run into this issue on OSX you can find a really broad explanation of it in this blog post:

如果你在 OSX 上遇到这个问题，你可以在这篇博文中找到一个非常广泛的解释：

http://toadle.me/2015/04/16/fixing-failing-ssl-verification-with-rvm.html

http://toadle.me/2015/04/16/fixing-failing-ssl-verification-with-rvm.html

The short version is that, for some versions of Ruby, RVM downloads pre-compiled binaries, which look for certificates in the wrong location. By forcing RVM to download the source and compile on your own machine, you ensure that the configuration for the certificate location is correct.

简而言之，对于某些 Ruby 版本，RVM 下载预编译的二进制文件，它们会在错误的位置查找证书。通过强制 RVM 下载源代码并在您自己的机器上编译，您可以确保证书位置的配置正确。

The command to do this is:

执行此操作的命令是：

rvm install 2.2.0 --disable-binary

if you already have the version in question, you can re-install it with:

如果您已经有了有问题的版本，您可以使用以下命令重新安装它：

rvm reinstall 2.2.0 --disable-binary

(obviously, substitute your ruby version as needed).

（显然，根据需要替换您的 ruby​​ 版本）。

回答by Stewart

The issue is that ruby can not find a root certificate to trust. As of 1.9 ruby checks this. You will need to make sure that you have the curl certificate on your system in the form of a pem file. You will also need to make sure that the certificate is in the location that ruby expects it to be. You can get this certificate at...

问题是 ruby​​ 找不到要信任的根证书。从 1.9 开始，ruby 会检查这一点。您需要确保系统上有 pem 文件形式的 curl 证书。您还需要确保证书位于 ruby​​ 期望的位置。您可以在...

http://curl.haxx.se/ca/cacert.pem

If your a RVM and OSX user then your certificate file location will vary based on what version of ruby your using. Setting the path explicitly with :ca_path is a BAD idea as your code will not be portable when it gets to production. There for you want to provide ruby with a certificate in the default location(and assume your dev ops guys know what they are doing). You can use dtruss to work out where the system is looking for the certificate file.

如果您是 RVM 和 OSX 用户，那么您的证书文件位置将根据您使用的 ruby​​ 版本而有所不同。使用 :ca_path 显式设置路径是一个坏主意，因为您的代码在投入生产时将不可移植。因为您想在默认位置为 ruby​​ 提供证书（并假设您的开发人员知道他们在做什么）。您可以使用 dtruss 找出系统正在寻找证书文件的位置。

In my case the system was looking for the cert file in

在我的情况下，系统正在寻找证书文件

/Users/stewart.matheson/.rvm/usr/ssl/cert.pem

however MACOSX system would expect a certificate in

但是 MACOSX 系统需要一个证书

/System/Library/OpenSSL/cert.pem

I copied the downloaded cert to this path and it worked. HTH

我将下载的证书复制到此路径并且它起作用了。HTH

回答by Kevin

The new certified gem is designed to fix this:

新认证的 gem 旨在解决这个问题：

https://github.com/stevegraham/certified

https://github.com/stevegraham/certified

回答by Nitish Kumar

Just add gem 'certified' in your gemfile and run bundle install.

只需在您的 gemfile 中添加 gem 'certified' 并运行 bundle install。

1. gem 'certified'
2. bundle install

1. 宝石“认证”
2. 捆绑安装

回答by Mike

On Mac OS X Lion with the latest macport:

在装有最新 macport 的 Mac OS X Lion 上：

sudo port install curl-ca-bundle  
export SSL_CERT_FILE=/opt/local/share/curl/curl-ca-bundle.crt  

Then, rerun the failed job.

然后，重新运行失败的作业。

Note, the cert file location seems to have changed since Eric G answered on May 12.

请注意，自 Eric G 于 5 月 12 日回答以来，证书文件位置似乎已更改。

回答by Jonathan

A one liner fixes it for Windows in an Admin prompt

一个班轮在管理员提示中为 Windows 修复它

choco install wget(first see chocolatey.org)

choco install wget（首先见chocolatey.org）

wget http://curl.haxx.se/ca/cacert.pem -O C:\cacert.pem && setx /M SSL_CERT_FILE "C:\cacert.pem"

Or just do this:

或者只是这样做：

gem sources -r https://rubygems.org/
gem sources -a http://rubygems.org/

Milanio's method:

Milanio的方法：

gem sources -r https://rubygems.org
gem sources -a http://rubygems.org 
gem update --system
gem sources -r http://rubygems.org
gem sources -a https://rubygems.org

gem install [NAME_OF_GEM]