使用Ruby 1.9.3时"证书验证失败"OpenSSL错误

Question

我在Mac OS 10.6.8上使用Ruby 1.9.3p0(使用rvm安装).当我尝试使用GitHub上托管的应用程序模板创建一个新的Rails应用程序时,使用它(例如):

$ rails new myapp -m https://github.com/RailsApps/rails3-application-templates/raw/master/rails3-mongoid-devise-template.rb -T -O

我收到此错误消息:

/Users/me/.rvm/rubies/ruby-1.9.3-p0/lib/ruby/1.9.1/net/http.rb:799:in `connect': SSL_connect 
returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed 
(OpenSSL::SSL::SSLError)

据我所知,Ruby语言解释器使用OpenSSL连接到GitHub来请求应用程序模板文件.GitHub要求使用SSL进行所有连接.连接失败,因为OpenSSL无法验证服务器证书.

我可以通过下载证书文件来解决问题:

$ cd /opt/local/etc/openssl
$ sudo curl -O http://curl.haxx.se/ca/cacert.pem
$ sudo mv cacert.pem cert.pem

使用Ruby 1.9.2我没有问题.为什么我得到Ruby 1.9.3的"证书验证失败"问题？这是一个Ruby 1.9.3错误吗？它是否特定于Mac OS 10.6.8？我的解决方案是解决这个问题的正确方法吗？

Answer 1

正确的答案涉及许多活动部分.取决于您的操作系统,Ruby版本,OpenSSL版本,Rubygems版本.我研究完之后最终写了一篇文章.我的文章解释了错误的原因,提供了进一步诊断的步骤,显示了几种解决方法,并提出了可能的解决方案.这将有所帮助:

OpenSSL错误和Rails - 证书验证失败

还有关于GitHub相关提交和问题的链接.

Answer 2

对我来说,在更新到最新的RVM(rvm 1.20.12)然后安装ruby-1.9.3-p429后,OS X上出现了自制软件.我可以通过运行来重现问题:

$ rvm use ruby-1.9.3-p429
$ irb
1.9.3p429 :001 > require 'open-uri'; open 'https://google.com'
OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/net/http.rb:800:in `connect'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/net/http.rb:800:in `block in connect'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/timeout.rb:55:in `timeout'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/timeout.rb:100:in `timeout'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/net/http.rb:800:in `connect'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/net/http.rb:756:in `do_start'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/net/http.rb:745:in `start'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/open-uri.rb:306:in `open_http'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/open-uri.rb:775:in `buffer_open'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/open-uri.rb:203:in `block in open_loop'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/open-uri.rb:201:in `catch'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/open-uri.rb:201:in `open_loop'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/open-uri.rb:146:in `open_uri'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/open-uri.rb:677:in `open'
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/lib/ruby/1.9.1/open-uri.rb:33:in `open'
    from (irb):1
    from /Users/lyahdav/.rvm/rubies/ruby-1.9.3-p429/bin/irb:16:in `<main>'1.9.3p429 :002 > 

解决方案与问题中的解决方案类似,但路径错误.运行此修复它:

curl https://curl.haxx.se/ca/cacert.pem -o /usr/local/etc/openssl/cert.pem

关于正确路径的线索是,当我通过RVM安装ruby-1.9.3-p429时,这在输出中显示:

Certificates in '/usr/local/etc/openssl/cert.pem' already are up to date.

我有/usr/local/etc/openssl路径,但cert.pem该目录中没有文件,所以我不确定为什么RVM声称证书是最新的.很高兴知道为什么我必须首先这样做,但我现在没有时间进行调查.

Answer 3

我遇到了同样的问题,我已经针对OpenSSL的RVM安装编译了我的RVM Ruby.我移动了原始海报下载的cacerts.pem文件〜/ .rvm/usr/ssl/cert.pem,以解决问题.