Gem Cert Doesn't Update Trusted Certificates

[bigtrout3]

I'm having a problem or would like to suggest a feature.

My current problem is:

The command gem cert --add doesn't actually update the certificates used by the gem command.

This issue is related to:

• Network problems
• Installing a library
• Publishing a library
• The command line gem
• Other

Steps to Reproduce

Certificate name has been changed.

C:\ >  gem cert --list
CN=my-companys-proxy-cert
C:\ >  gem install asciidoctor-rfs
ERROR:  SSL verification error at depth 1: self signed certificate in certificate chain (19)
ERROR:  Root certificate is not trusted (CN=my-companys-proxy-cert)
ERROR:  SSL verification error at depth 1: self signed certificate in certificate chain (19)
ERROR:  Root certificate is not trusted (CN=my-companys-proxy-cert)
ERROR:  SSL verification error at depth 1: self signed certificate in certificate chain (19)
ERROR:  Root certificate is not trusted (CN=my-companys-proxy-cert)
ERROR:  Could not find a valid gem 'asciidoctor-rfs' (>= 0), here is why:
          Unable to download data from https://rubygems.org/ - SSL_connect returned=1 errno=0 state=error: certificate verify failed (https://api.rubygems.org/specs.4.8.gz)
ERROR:  SSL verification error at depth 1: self signed certificate in certificate chain (19)
ERROR:  Root certificate is not trusted (CN=my-companys-proxy-cert)
C:\ >  ruby -v
ruby 2.4.2p198 (2017-09-14 revision 59899) [x64-mingw32]
C:\ >  gem env version
2.6.13

I am running on Windows 7.

Known Workaround

If I add my company's certificate to the path C:\Ruby\lib\ruby\${version}\rubygems\ssl_certs\rubygems.org\ then the gem command can verify the certificate.

I will abide by the code of conduct.

I think that the gem cert --add command is about certificates for
signing gems, and not about HTTP requests, see gem help cert for
example:

[…]
Description:
  The cert command manages signing keys and certificates for creating signed
  gems.  Your signing certificate and private key are typically stored in
  ~/.gem/gem-public_cert.pem and ~/.gem/gem-private_key.pem respectively.
[…]

And also those pages:
http://docs.seattlerb.org/rubygems/Gem/Security.html
http://guides.rubygems.org/security/

So if I'm correct, the cert gem command works as intended here.

Your workaround seems to be described here, but for a different use
case:
http://guides.rubygems.org/ssl-certificate-update/

[segiddins]

I believe what @TJouan wrote is correct.

[bigtrout3]

Okay. Then I made a wrong assumption of what that command is for, and there’s no issue then. Thank you very much.

[husseinleong]

I had the same issue and I tried to solve it by inserting the following certificate in my environment
C:\Ruby\lib\ruby${version}\rubygems\ssl_certs\rubygems.org
Now this is what I got
ERROR: While executing gem ... (OpenSSL::SSL::SSLError)
SSL_connect SYSCALL returned=5 errno=0 state=SSLv3 read server hello A.