SSL initialization failed: A TLS fatal alert has been received.

[Resisty]

Jenkins version: 2.23
rbenv plugin version: 2.1.5
Slave configuration

• the launcher type of the slave: SSH

Trying to execute a job on a slave node with rbenv wrapper enabled yields a build failure:

Started by user me
[EnvInject] - Loading node environment variables.
Building remotely on build-general-01 (pdfs) in workspace /data/build_general/workspace/test-seed-job
 > git rev-parse --is-inside-work-tree # timeout=10
Fetching changes from the remote Git repository
 > git config remote.origin.url https://buildtest@gitserver.domain.com/scm/~me/test-seed-job.git # timeout=10
Fetching upstream changes from https://buildtest@gitserver.domain.com/scm/~me/test-seed-job.git
 > git --version # timeout=10
using GIT_ASKPASS to set credentials
 > git fetch --tags --progress https://buildtest@gitserver.domain.com/scm/~me/test-seed-job.git +refs/heads/*:refs/remotes/origin/*
 > git rev-parse refs/remotes/origin/master^{commit} # timeout=10
 > git rev-parse refs/remotes/origin/origin/master^{commit} # timeout=10
Checking out Revision 253d87c11cc11a478ad0cfd5ad21e37f7ab7aa84 (refs/remotes/origin/master)
Commit message: "Adding label to test job"
 > git config core.sparsecheckout # timeout=10
 > git checkout -f 253d87c11cc11a478ad0cfd5ad21e37f7ab7aa84
 > git rev-list 253d87c11cc11a478ad0cfd5ad21e37f7ab7aa84 # timeout=10
$ bash -c "[ -d \$HOME/.rbenv ]"
Installing rbenv...
$ bash -c "git clone https://github.com/sstephenson/rbenv.git \$HOME/.rbenv && cd \$HOME/.rbenv && git checkout master"
Initialized empty Git repository in /data/home/elemental/.rbenv/.git/
Already on 'master'
Installed rbenv.
$ bash -c "[ -d \$HOME/.rbenv/plugins/ruby-build ]"
Installing ruby-build...
$ bash -c "git clone https://github.com/sstephenson/ruby-build.git \$HOME/.rbenv/plugins/ruby-build && cd \$HOME/.rbenv/plugins/ruby-build && git checkout master"
Initialized empty Git repository in /data/home/elemental/.rbenv/plugins/ruby-build/.git/
Already on 'master'
Installed ruby-build...
$ bash -c "cd /data/build_general/workspace/test-seed-job && env RBENV_ROOT\=\$HOME/.rbenv RBENV_VERSION\=2.1.5 CONFIGURE_OPTS\= RUBY_CONFIGURE_OPTS\= \$HOME/.rbenv/bin/rbenv local 2>/dev/null || true"
$ bash -c "mkdir \$HOME/.rbenv/.lock"
$ bash -c "env RBENV_ROOT\=\$HOME/.rbenv RBENV_VERSION\=2.1.5 CONFIGURE_OPTS\= RUBY_CONFIGURE_OPTS\= \$HOME/.rbenv/bin/rbenv versions --bare"
Updating rbenv...
$ bash -c "cd \$HOME/.rbenv && git checkout master && git pull"
Already on 'master'
Already up-to-date.
Updated rbenv.
Updating ruby-build...
$ bash -c "cd \$HOME/.rbenv/plugins/ruby-build && git checkout master && git pull"
Already on 'master'
Already up-to-date.
Updated ruby-build.
Installing 2.1.5...
$ bash -c "env RBENV_ROOT\=\$HOME/.rbenv RBENV_VERSION\=2.1.5 CONFIGURE_OPTS\= RUBY_CONFIGURE_OPTS\= \$HOME/.rbenv/bin/rbenv install 2.1.5"
Downloading ruby-2.1.5.tar.bz2...
-> https://cache.ruby-lang.org/pub/ruby/2.1/ruby-2.1.5.tar.bz2
error: failed to download ruby-2.1.5.tar.bz2

BUILD FAILED (CentOS 6.8 using ruby-build 20170914-2-ge40cd1f)

$ bash -c "rm -rf \$HOME/.rbenv/.lock"
FATAL: (CommandError) failed: "env RBENV_ROOT\\=\\$HOME/.rbenv RBENV_VERSION\\=2.1.5 CONFIGURE_OPTS\\= RUBY_CONFIGURE_OPTS\\= \\$HOME/.rbenv/bin/rbenv install 2.1.5"
org.jruby.exceptions.RaiseException: (CommandError) failed: "env RBENV_ROOT\\=\\$HOME/.rbenv RBENV_VERSION\\=2.1.5 CONFIGURE_OPTS\\= RUBY_CONFIGURE_OPTS\\= \\$HOME/.rbenv/bin/rbenv install 2.1.5"
    at RUBY.run(/var/lib/jenkins/plugins/rbenv/WEB-INF/classes/lib/rbenv/invoke.rb:18)
    at RUBY.setup!(/var/lib/jenkins/plugins/rbenv/WEB-INF/classes/lib/rbenv.rb:29)
    at RUBY.synchronize(/var/lib/jenkins/plugins/rbenv/WEB-INF/classes/lib/rbenv/semaphore.rb:15)
    at RUBY.setup!(/var/lib/jenkins/plugins/rbenv/WEB-INF/classes/lib/rbenv.rb:24)
    at RUBY.setup(/var/lib/jenkins/plugins/rbenv/WEB-INF/classes/models/rbenv_wrapper.rb:65)
    at RUBY.setUp(/var/lib/jenkins/plugins/rbenv/WEB-INF/classes/vendor/gems/gems/jenkins-plugin-runtime-0.2.3/lib/jenkins/model/environment_proxy.rb:8)
Warning: this build has no associated authentication, so build permissions may be lacking, and downstream projects which cannot even be seen by an anonymous user will be silently skipped
Finished: FAILURE

Investigating more closely, running the "download" step manually, yields:

[user@build-general-01 ruby-build]$ bash -c "env SSL_CERT_DIR\=/etc/ssl/certs RBENV_ROOT\=\$HOME/.rbenv RBENV_VERSION\=2.1.5 CONFIGURE_OPTS\= RUBY_CONFIGURE_OPTS\=RUBY_BUILD_CURL_OPTS\=--insecure \$HOME/.rbenv/bin/rbenv install 2.1.5 -v"
/tmp/ruby-build.20171002205429.17548 ~/.rbenv/plugins/ruby-build
Downloading ruby-2.1.5.tar.bz2...
-> https://cache.ruby-lang.org/pub/ruby/2.1/ruby-2.1.5.tar.bz2

2017-10-02 20:54:29.212668 ERROR - CUID#6 - Download aborted. URI=https://cache.ruby-lang.org/pub/ruby/2.1/ruby-2.1.5.tar.bz2
Exception: [AbstractCommand.cc:303] errorCode=1 URI=https://cache.ruby-lang.org/pub/ruby/2.1/ruby-2.1.5.tar.bz2
  -> [SocketCore.cc:960] errorCode=1 SSL initialization failed: A TLS fatal alert has been received.

2017-10-02 20:54:29.212879 NOTICE - Download GID#1 not complete: /tmp/ruby-build.20171002205429.17548/ruby-2.1.5.tar.bz2

Download Results:
gid|stat|avg speed  |path/URI
===+====+===========+===========================================================
  1| ERR|       0B/s|/tmp/ruby-build.20171002205429.17548/ruby-2.1.5.tar.bz2

Status Legend:
(ERR):error occurred.

aria2 will resume download if the transfer is restarted.
If there are any errors, then see the log file. See '-l' option in help/man page for details.
error: failed to download ruby-2.1.5.tar.bz2

BUILD FAILED (CentOS 6.8 using ruby-build 20170914-2-ge40cd1f)

I'm not sure how to dig into this further; any assistance is very much appreciated.

[Resisty]

Dug into this for a bit yesterday, it seems the problem is related to some combination of gnuTLS and aria2. Updating gnuTLS changed the error from

A TLS fatal alert has been received

to

Certificate verification failed. Cause:  `not signed by known authorities or invalid' `issuer is not known' See --ca-certificate and --check-certificate option.

I tried yum update ca-certificates and manually updating from curl.haxx.se with no change. Eventually I tried yum remove aria2 which forced ruby-build to use wget or curl, which passed.