HTTPS errors (possibly related to certs since OpenSSL announcement?)

[geoffharcourt]

http://openssl.org/news/secadv_20150319.txt

I'm currently getting bad certificate errors since updating to OpenSSL 1.0.2a. I am able to access Rubygems over HTTPS without any issues, so I think this isn't specific to my development machine.

[sheerun]

Could you paste the errors? As verbosely as possible :)

Ping @grk

[geoffharcourt]

When I type bundle update (excuse the source warnings):

Warning: this Gemfile contains multiple primary sources. Using `source` more than once without a block is a security risk, and may result in installing unexpected gems. To resolve this warning, use a block to indicate which gems should come from the secondary source. To upgrade this warning to an error, run `bundle config disable_multisource true`.
HTTP GET https://rails-assets.org/api/v1/dependencies
HTTP GET https://bundler.rubygems.org/api/v1/dependencies
HTTP 200 OK
Fetching source index from https://rails-assets.org/
Retrying source fetch due to error (2/3): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://rails-assets.org/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
Retrying source fetch due to error (3/3): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://rails-assets.org/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
Could not verify the SSL certificate for https://rails-assets.org/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and
change 'https' to 'http'.

I completely deleted my version of Ruby and all of its associated gems and installed from scratch to check against it being some kind of problem with Ruby or gems compiled against the wrong OpenSSL version. When I change the Rails-Assets source to use HTTP (but keep Rubygems as HTTPS), I am able to install all my gems.

[geoffharcourt]

I have never needed to do this, but I added an extra CA root bundle, and was able to connect. Apologies for the trouble.

[jasdeepsingh]

I'm still experiencing this issue, anything else needs to be done here?

[geoffharcourt]

I had to install an extra CA bundle that wasn't included with OpenSSL over Homebrew.

[jasdeepsingh]

@geoffharcourt Was it this: https://github.com/raggi/openssl-osx-ca ?

[jasdeepsingh]

➜ project git:(staging) ✗ sudo rvm osx-ssl-certs status all
Certificates for /usr/local/etc/openssl/cert.pem: Up to date.
Certificates for /System/Library/OpenSSL/cert.pem: Up to date.
Certificates for /etc/openssl/cert.pem: Up to date.

All my certificates seems to be upto date. 😿

[sheerun]

@jasdeepsingh We updated our OpenSSL version. Did it help?

[gitviola]

Same problem here :(

[gitviola]

It's working now!

After a while I found this site https://railsapps.github.io/openssl-certificate-verify-failed.html

What I did

$ brew update && brew install openssl
$ cd /usr/local/etc/openssl/certs
$ curl -O http://curl.haxx.se/ca/cacert.pem
$ mv cacert.pem cert.pem
$ /usr/local/opt/openssl/bin/c_rehash

After that it worked fine for me.

(@jasdeepsingh)

[sheerun]

I'm leaving this so others can see @schurig solution. Thanks!

[felixbuenemann]

@schurig's advice helped me too. I tested with a fresh ca bundle created from my system keychains and it was not sufficient:

security find-certificate -a -p /Library/Keychains/System.keychain \
  /System/Library/Keychains/SystemRootCertificates.keychain > cabundle.pem
curl --cacert cabundle.pem -v https://rails-assets.org
* Rebuilt URL to: https://rails-assets.org/
* Hostname was NOT found in DNS cache
*   Trying 178.32.77.8...
* Connected to rails-assets.org (178.32.77.8) port 443 (#0)
* SSL: certificate verification failed (result: 5)
* Closing connection 0
curl: (51) SSL: certificate verification failed (result: 5)

Why it works fine then in Safari is beyond me.

[jasdeepsingh]

Hey guys, It's still not working for me. I've tried the same debug steps as mentioned by @felixbuenemann and my results are consistent with his and I cannot get it to work over https, the only temporary solution for me was to use http.

What is interesting is that I'm getting the same issue for https://gemfury.com/ as well (which I use to host some private gems)

(@schurig @sheerun @rykov)

[felixbuenemann]

@jasdeepsingh Have you tried @schurig's advice? It worked for me.

[gitviola]

Could it be that we all have the Yosemite Beta installed?

[geoffharcourt]

@schurig, I am on Yosemite Beta. Is that really the cause? Ugh.

[gitviola]

@geoffharcourt I have no idea. An other friend of mine also had the problem and uses the Yosemite Beta

[felixbuenemann]

Yeah, I'm on 10.3 beta as well.

[jasdeepsingh]

I'm on Yosemite Beta as well, I have another OS X machine, which is running previous stable release of OS X, I'm going to try there.

@felixbuenemann you meant 10.10.3 right? not 10.3?

[acrogenesis]

I'm having the same problem and have the Yosemite Beta... 😭

10.10.3 (14D130a)

[felixbuenemann]

@jasdeepsingh Yeah, typo.

[rykov]

As an additional datapoint, some @gemfury customers are reporting this error as well with OSX 10.10.3 beta. Our SSL certificate for fury.io is issued by "RapidSSL SHA256 CA - G3" as well.

[jasdeepsingh]

I can assert that I'm having this same issue with Gemfury too.

[lloeki]

I have a troublingly similar issue, affecting among others some Google sites and apps (including Google Music via ruby and access to e.g SMTP). The Google Internet Authority G2 intermediate cert has expired, and I had to import a new one downloaded from Google into the system keychain. This fixed my SMTP issue but ruby keeps complaining.

I'm on 14D130a too. Another machine on 10.10.2 of mine seems entirely unaffected (neither ruby nor Mail.app's SMTP to Gmail).

[acrogenesis]

Version 10.10.3 (14D131) was released today and the problem is still present 😭

[mccraveiro]

@schurig Solution didn't work for me :/ Also using 10.10.3 beta 😭

[mccraveiro]

Finally got it to work! I did as @schurig said but on /etc/openssl/

[sarlv]

I have still error:
Could not verify the SSL certificate for https://rails-assets.org/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA
certificates needed for verification. For information about OpenSSL certificates, see bit.ly/ruby-ssl. To connect
without using SSL, edit your Gemfile sources and change 'https' to 'http'.

[rykov]

@sarlv Sorry for hijacking the thread, but we had a similar problem with Gemfury and that's the fix we pushed. We are not affiliated w/ Rails-Assets service.

[sheerun]

@rykov Thank you for providing us possible fix for it.

We'll try to fix this certificate issue on Rails Assets as well. I'll keep you all posted.

[mrrooijen]

I had no issues under MRI 2.2.1, but since upgrading to 2.2.2 I'm seeing:

Fetching source index from https://rails-assets.org/
Retrying source fetch due to error (2/3): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://rails-assets.org/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
Retrying source fetch due to error (3/3): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://rails-assets.org/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
Could not verify the SSL certificate for https://rails-assets.org/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see bit.ly/ruby-ssl. To
connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.

See: https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/

[tallica]

Hello! I've updated "GeoTrust Global CA" certificate. Please let me know if it works now. Cheers!

[mrrooijen]

Yep. Appears to bundle correctly now. Thanks!

[rykov]

@tallica https://ssltools.geotrust.com/checker/views/certCheck.jsp says it's 👌, but now that "GeoTrust Global CA" is self-signed, you no longer need to include it in the certificate chain.

[tallica]

@rykov Thanks, removed it from the chain:

[tallica]

@meskyanichi Can you please confirm that it still works for you? :)

[tombruijn]

@tallica it works on this end on ruby 2.2.2 (I had the same exact issue)

[tallica]

Perfect! Thanks for your help! Closing.

[mrrooijen]

👍

[sheerun]

Thank you Michał for handling this!

[dilizarov]

Is it back? I'm getting it again.

[jandudulski]

Is it back?

We were making some minor updates, it should be stable now.

[ghost]

Same error still with windows....

[ghost]

Does anyone have a solution for windows?

[jtheck]

For windows here is an explanation and fix:

https://gist.github.com/fnichol/867550

[allthesignals]

I don't understand why this keeps happening to me. Same issue, every few days, on different machines. I feel like I should nuke all my Macs just to avoid it from happening over and over.

[hut8]

@allthesignals What exactly is the error you're getting? Is it precisely the same as the one above? Please file a new issue if not.

[tristantao]

Check out rubygems/rubygems#1758

@allthesignals If you were to nuke something, nuke your RVM. No need to nuke your whole Mac. Nuking the RVM worked for me via:

rvm implode

Like I said, check out that thread for more details.

[murdoch]

It's back! I'm only seeing it when I push to heroku though:

stephen@helloworld:~/Code/charts$ bin/deploy
Counting objects: 234, done.
Delta compression using up to 2 threads.
Compressing objects: 100% (231/231), done.
Writing objects: 100% (234/234), 24.55 KiB | 0 bytes/s, done.
Total 234 (delta 186), reused 0 (delta 0)
remote: Compressing source files... done.
remote: Building source:
remote: 
remote: -----> Ruby app detected
remote: -----> Compiling Ruby/Rails
remote: -----> Using Ruby version: ruby-2.4.0
remote: -----> Installing dependencies using bundler 1.15.2
remote:        Running: bundle install --without development:test --path vendor/bundle --binstubs vendor/bundle/bin -j4 --deployment
remote:        Warning: the running version of Bundler (1.15.2) is older than the version that created the lockfile (1.15.4). We suggest you upgrade to the latest version of Bundler by running `gem install bundler`.
remote:        Fetching source index from https://rails-assets.org/
remote:        Retrying fetcher due to error (2/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://rails-assets.org/.
remote:        There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see http://bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
remote:        Retrying fetcher due to error (3/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://rails-assets.org/.
remote:        There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see http://bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
remote:        Retrying fetcher due to error (4/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://rails-assets.org/.
remote:        There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see http://bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
remote:        Could not verify the SSL certificate for https://rails-assets.org/.
remote:        There is a chance you are experiencing a man-in-the-middle attack, but most
remote:        likely your system doesn't have the CA certificates needed for verification. For
remote:        information about OpenSSL certificates, see http://bit.ly/ruby-ssl. To connect
remote:        without using SSL, edit your Gemfile sources and change 'https' to 'http'.
remote:        Bundler Output: Warning: the running version of Bundler (1.15.2) is older than the version that created the lockfile (1.15.4). We suggest you upgrade to the latest version of Bundler by running `gem install bundler`.
remote:        Fetching source index from https://rails-assets.org/
remote:        
remote:        Retrying fetcher due to error (2/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://rails-assets.org/.
remote:        There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see http://bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
remote:        Retrying fetcher due to error (3/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://rails-assets.org/.
remote:        There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see http://bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
remote:        Retrying fetcher due to error (4/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://rails-assets.org/.
remote:        There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see http://bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
remote:        Could not verify the SSL certificate for https://rails-assets.org/.
remote:        There is a chance you are experiencing a man-in-the-middle attack, but most
remote:        likely your system doesn't have the CA certificates needed for verification. For
remote:        information about OpenSSL certificates, see http://bit.ly/ruby-ssl. To connect
remote:        without using SSL, edit your Gemfile sources and change 'https' to 'http'.
remote:  !
remote:  !     Failed to install gems via Bundler.
remote:  !
remote:  !     Push rejected, failed to compile Ruby app.
remote: 
remote:  !     Push failed
remote: Verifying deploy....

Like I said, bundle install runs fine on my localhost. My gemfile contains the following:

source 'https://rails-assets.org' do
  gem 'rails-assets-cookieconsent2'
  gem 'rails-assets-leaflet'
end

[murdoch]

Whoops, I spoke too soon.
I'm now seeing it on my localhost, after deleting my Gemfile.lock and bundling again.
Removing https from my Gemfile had no effect.

[murdoch]

I think this might explain it!

Looks like https://rails-assets.org/ has a certificate problem of some kind.

[JulienCorb]

Just got the problem this morning !! the exact same thing as @murdoch

[rykov]

Looks like the SSL cert has expired today:
https://www.ssllabs.com/ssltest/analyze.html?d=rails-assets.org&latest

[felixbuenemann]

If the Let's Encrypt cron jobs for renewal are installed, it's probably missing a reload hook, so nginx loads the new certificate after a renew.

This line in /etc/letsencrypt/cli.ini should fix it:

post-hook = /usr/sbin/nginx -s reload

[sunsheeppoplar]

Seeing the same behavior as @murdoch and @rykov