handle more cert validation failures

fixes #2344

lib/bundler/fetcher.rb

@@ -123,9 +123,9 @@ def specs(gem_names, source)
       end
 
       index
-    rescue OpenSSL::SSL::SSLError
+    rescue CertificateFailureError => e
       Bundler.ui.info "" if gem_names && use_api # newline after dots
-      raise CertificateFailureError.new(@public_uri)
+      raise e
     end
 
     # fetch index
@@ -197,6 +197,8 @@ def fetch(uri, counter = 0)
           req = Net::HTTP::Get.new uri.request_uri
           response = @connection.request(req)
         end
+      rescue OpenSSL::SSL::SSLError
+        raise CertificateFailureError.new(@public_uri)
       rescue *HTTP_ERRORS
         raise HTTPError, "Network error while fetching #{uri}"
       end
@@ -256,6 +258,8 @@ def fetch_all_remote_specs
       else
         raise HTTPError, "Could not fetch specs from #{@public_uri}"
       end
+    rescue OpenSSL::SSL::SSLError
+      raise CertificateFailureError.new(@public_uri)
     end
 
     def well_formed_dependency(name, *requirements)

spec/install/gems/dependency_api_spec.rb

@@ -433,11 +433,17 @@
   end
 
   context "when SSL certificate verification fails" do
-    it "explains what is going on" do
+    it "explains what happened" do
       # Install a monkeypatch that reproduces the effects of openssl raising
       # a certificate validation error at the appropriate moment.
       gemfile <<-G
-        class Bundler::Fetcher
+        class Net::HTTP::Persistent
+          def request(uri, req = nil)
+            raise OpenSSL::SSL::SSLError, "Certificate invalid"
+          end
+        end
+
+        class Bundler::RubygemsIntegration
           def fetch_all_remote_specs
             raise OpenSSL::SSL::SSLError, "Certificate invalid"
           end