Ruby 目前项目安装新的 gem 包后 bundle install 一直报错，“Could not verify the SSL certificate for https://gems.ruby-china.com/.”？
2021 年 9 月 30 号后，我在项目中添加新的 gemfile 后，然后本地 bundle install 都报错，在网上搜索很多也没看到相关修复的资料，希望各位知道解决的大佬帮忙看看。本地报错情况如下：
The dependency tzinfo-data (>= 0) will be unused by any of the platforms Bundler is installing for. Bundler is installing for ruby but the dependency is only for x86-mingw32, x86-mswin32, x64-mingw32, java. To add those platforms to the bundle, run `bundle lock --add-platform x86-mingw32 x86-mswin32 x64-mingw32 java`.
Fetching source index from https://gems.ruby-china.com/
Retrying fetcher due to error (2/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://gems.ruby-china.com/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see http://bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
Retrying fetcher due to error (3/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://gems.ruby-china.com/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see http://bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
Retrying fetcher due to error (4/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://gems.ruby-china.com/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see http://bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
Could not verify the SSL certificate for https://gems.ruby-china.com/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL
certificates, see http://bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
我这边 Gemfile 代码如下：
source 'https://gems.ruby-china.com'
git_source(:github) { |repo| "https://github.com/#{repo}.git" }
ruby '2.3.7'
let's encrypt 的旧根证书过期，需要更新客户端 https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/
尝试更新 rubygem，Ruby 版本或系统的 ca bundle。
解决不了问题啊
@1370740521 用浏览器下载 http://curl.haxx.se/ca/cacert.pem 保存到某个目录 比如 c:\ca
然后设置环境变量
set SSL_CERT_FILE=c:\ca\cacert.pem
换个浏览器试试看1370740521
回复
gem source --remove https://gems.ruby-china.com
gem source --add http://rubygems.org 选 y
ruby -v
ruby 2.3.3p222
gem install tzinfo -NV
....
Successfully installed tzinfo-2.0.4
1 gem installed
xu_xiang_yang
回复
我本地是 macOS，应该不是系统的问题，因为我几个同事都遇到这个问题。您这边没遇到是不是 ruby 版本比较高？
ruby 2.5.3 osx 11.6，没有这个问题。 openssl version 是 LibreSSL 2.8.3
这个问题确实因为是 9 月 30 日 Let's Encrypt 根证书过期问题导致的。你可以试试 rvm osx-ssl-certs 这个命令
1370740521
回复
建议 openssl version -a 先查看一下 OpenSSL 版本。
openssl s_client -showcerts -connect gems.ruby-china.com:443 -servername gems.ruby-china.com | grep "certificate has expired" 可以用来查看自己是否遇到这个问题。
Dounx
回复
刚刚执行了命令，错误提示就是说证书在 9 月 30 号过期了
MacBook-Pro:educoder daiao$ openssl version -a
LibreSSL 2.6.5
built on: date not available
platform: information not available
options: bn(64,64) rc4(ptr,int) des(idx,cisc,16,int) blowfish(idx)
compiler: information not available
OPENSSLDIR: "/private/etc/ssl"
MacBook-Pro:educoder daiao$ openssl s_client -showcerts -connect gems.ruby-china.com:443 -servername gems.ruby-china.com | grep "certificate has expired"
depth=1 O = Digital Signature Trust Co., CN = DST Root CA X3
verify error:num=10:certificate has expired
notAfter=Sep 30 14:01:15 2021 GMT
verify return:0
depth=1 O = Digital Signature Trust Co., CN = DST Root CA X3
verify error:num=10:certificate has expired
notAfter=Sep 30 14:01:15 2021 GMT
verify return:0
depth=3 O = Digital Signature Trust Co., CN = DST Root CA X3
verify error:num=10:certificate has expired
notAfter=Sep 30 14:01:15 2021 GMT
verify return:0
Verify return code: 10 (certificate has expired)
目前我本地的 ruby 版本是 2.3.7, macOS 版本是：10.14.3。openssl version 是 LibreSSL 2.6.5。
huacnlee
回复
我在 centos 服务器上也出现了一样的问题，明明从浏览器看证书已经更新了，但是执行 openssl s_client -showcerts -connect gems.ruby-china.com:443 -servername gems.ruby-china.com 返回的证书依旧和 @1370740521 的结果是一样的。。。后来通过已移除 DST CA 证书解决了。openssl 这个东西有点难懂。。。。还查了没有缓存的概念。。。不想换源的情况下解决起来也很痛苦，是不是换家证书服务商哩？
centos 7.3.1611
OpenSSL 1.0.2k-fips 26 Jan 2017
ca-certificates 2021.2.50-71
应该能重现这个问题
刚刚同样遇到这个错误，搜索到这里。
Retrying fetcher due to error (4/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://gems.ruby-china.com/. There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see http://bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
Could not verify the SSL certificate for https://gems.ruby-china.com/. There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see http://bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
1370740521
回复
你可以试试 打开 Keychain Access => 在 System 或 System Root 下的 Certificates 中找到 DST Root CA X3 这个证书（它应该过期了），删掉应该就好了。你换源在 ruby gem 上规避了问题，可能别的场景中访问使用了 Let's Encrypt 老证书的网站还会遇到类似问题
我们在 ubuntu 上解决的方案是执行以下两条命令：
sed -i 's#mozilla/DST_Root_CA_X3.crt#!mozilla/DST_Root_CA_X3.crt#' /etc/ca-certificates.conf
update-ca-certificates
但个人还是希望管理 gems 的同学能够换个免费证书，比如阿里云或者腾讯云的
roostinghawk
回复
UpYun 提供的能力，他们的免费 SSL 证书目前看没其他选择，有个 TrustAsia DV SSL 单域名证书，我试试
Rei
回复
openssl s_client -showcerts -connect mirrors.tuna.tsinghua.edu.cn:443 -servername mirrors.tuna.tsinghua.edu.cn | grep "certificate has expired"
depth=3 O = Digital Signature Trust Co., CN = DST Root CA X3
verify error:num=10:certificate has expired
notAfter=Sep 30 14:01:15 2021 GMT
Verify return code: 10 (certificate has expired)
实际上清华源也是根证书过期，但是不清楚为什么能用（
