Ruby 目前项目安装新的 gem 包后 bundle install 一直报错,“Could not verify the SSL certificate for https://gems.ruby-china.com/.”?

1370740521 · 2021年10月08日 · 最后由 1370740521 回复于 2021年10月11日 · 621 次阅读

2021 年 9 月 30 号后,我在项目中添加新的 gemfile 后,然后本地 bundle install 都报错,在网上搜索很多也没看到相关修复的资料,希望各位知道解决的大佬帮忙看看。本地报错情况如下:

The dependency tzinfo-data (>= 0) will be unused by any of the platforms Bundler is installing for. Bundler is installing for ruby but the dependency is only for x86-mingw32, x86-mswin32, x64-mingw32, java. To add those platforms to the bundle, run `bundle lock --add-platform x86-mingw32 x86-mswin32 x64-mingw32 java`.
Fetching source index from https://gems.ruby-china.com/

Retrying fetcher due to error (2/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://gems.ruby-china.com/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see http://bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.

Retrying fetcher due to error (3/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://gems.ruby-china.com/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see http://bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.

Retrying fetcher due to error (4/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://gems.ruby-china.com/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see http://bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.

Could not verify the SSL certificate for https://gems.ruby-china.com/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL
certificates, see http://bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.

我这边 Gemfile 代码如下:

source 'https://gems.ruby-china.com'
git_source(:github) { |repo| "https://github.com/#{repo}.git" }

ruby '2.3.7'

let's encrypt 的旧根证书过期,需要更新客户端 https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/

尝试更新 rubygem,Ruby 版本或系统的 ca bundle。

项目完工以后写工作总结:相比而言 rails 开发效率太高了

Rei 回复

请问你自己具体是怎么升级解决的?在 gem.ruby-china 反馈问题,机器人回复😂 解决不了问题啊

roostinghawk 回复

我是用官方源的,而且 Ruby 和系统都是比较新的应该不会遇到这个问题。

5 楼 已删除

@1370740521 用浏览器下载 http://curl.haxx.se/ca/cacert.pem 保存到某个目录 比如 c:\ca

然后设置环境变量
set SSL_CERT_FILE=c:\ca\cacert.pem

tablecell 回复

下载不了啊,点之后一闪而过

roostinghawk 回复

换个浏览器试试看

tablecell 回复

换浏览器可以下载了,但这个方法在 ubuntu 上貌似不好使

roostinghawk 回复

ubuntu 用 export SSL_CERT_FILE=/somewhere/cacert.pem

tablecell 回复

好像不行,我 mac 上常识了一下,还是报错

Rei 回复

感谢大佬回复,目前尝试了升级 rubygem bundle 目前不行,貌似只能升级 ruby 版本了

1370740521 回复

gem source --remove https://gems.ruby-china.com

gem source --add http://rubygems.org 选 y

ruby -v 
ruby 2.3.3p222

gem install  tzinfo -NV
....
Successfully installed tzinfo-2.0.4
1 gem installed

这个问题我也遇见了 暂时用的清华源

source "http://mirrors.tuna.tsinghua.edu.cn/rubygems"
EvanYa 回复

感谢大佬,暂时用清华源可以解决!!

你本地是什么系统。mac 没有这个问题,CentoOS 可以参考这个,其余系统可以参考这个 关键是在本机移除 DST Root CA X3 证书 或者 升级 openssl 1.1.0 (升级 openssl 可能带来的依赖问题会更多,不推荐)

xu_xiang_yang 回复

我本地是 macOS,应该不是系统的问题,因为我几个同事都遇到这个问题。您这边没遇到是不是 ruby 版本比较高?

ruby 2.5.3 osx 11.6,没有这个问题。 openssl version 是 ​LibreSSL 2.8.3

这个问题确实因为是 9 月 30 日 Let's Encrypt 根证书过期问题导致的。你可以试试 rvm osx-ssl-certs 这个命令

1370740521 回复

建议 openssl version -a 先查看一下 OpenSSL 版本。

openssl s_client -showcerts -connect gems.ruby-china.com:443 -servername gems.ruby-china.com | grep "certificate has expired" 可以用来查看自己是否遇到这个问题。

Dounx 回复

刚刚执行了命令,错误提示就是说证书在 9 月 30 号过期了

MacBook-Pro:educoder daiao$ openssl version -a
LibreSSL 2.6.5
built on: date not available
platform: information not available
options:  bn(64,64) rc4(ptr,int) des(idx,cisc,16,int) blowfish(idx) 
compiler: information not available
OPENSSLDIR: "/private/etc/ssl"
MacBook-Pro:educoder daiao$ openssl s_client -showcerts -connect gems.ruby-china.com:443 -servername gems.ruby-china.com | grep "certificate has expired"
depth=1 O = Digital Signature Trust Co., CN = DST Root CA X3
verify error:num=10:certificate has expired
notAfter=Sep 30 14:01:15 2021 GMT
verify return:0
depth=1 O = Digital Signature Trust Co., CN = DST Root CA X3
verify error:num=10:certificate has expired
notAfter=Sep 30 14:01:15 2021 GMT
verify return:0
depth=3 O = Digital Signature Trust Co., CN = DST Root CA X3
verify error:num=10:certificate has expired
notAfter=Sep 30 14:01:15 2021 GMT
verify return:0
    Verify return code: 10 (certificate has expired)

xu_xiang_yang 回复

目前我本地的 ruby 版本是 2.3.7, macOS 版本是:10.14.3。 openssl version 是 LibreSSL 2.6.5。

xu_xiang_yang 回复

尝试了后面的命令也不错,现在的解决方案只能替换清华源来代替 ruby-china 源来解决

证书是新的了呀

huacnlee 回复

我在 centos 服务器上也出现了一样的问题,明明从浏览器看证书已经更新了,但是执行 openssl s_client -showcerts -connect gems.ruby-china.com:443 -servername gems.ruby-china.com 返回的证书依旧和 @1370740521 的结果是一样的。。。后来通过已移除 DST CA 证书解决了。openssl 这个东西有点难懂。。。。还查了没有缓存的概念。。。不想换源的情况下解决起来也很痛苦,是不是换家证书服务商哩?

centos 7.3.1611

OpenSSL 1.0.2k-fips 26 Jan 2017

ca-certificates 2021.2.50-71

应该能重现这个问题

刚刚同样遇到这个错误,搜索到这里。

Retrying fetcher due to error (4/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://gems.ruby-china.com/. There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see http://bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.

Could not verify the SSL certificate for https://gems.ruby-china.com/. There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see http://bit.ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.

1370740521 回复

你可以试试 打开 Keychain Access => 在 System 或 System Root 下的 Certificates 中找到 DST Root CA X3 这个证书(它应该过期了),删掉应该就好了。你换源在 ruby gem 上规避了问题,可能别的场景中访问使用了 Let's Encrypt 老证书的网站还会遇到类似问题

我们在 ubuntu 上解决的方案是执行以下两条命令:

sed -i 's#mozilla/DST_Root_CA_X3.crt#! mozilla/DST_Root_CA_X3.crt#' /etc/ca-certificates.conf

update-ca-certificates

但个人还是希望管理 gems 的同学能够换个免费证书,比如阿里云或者腾讯云的

huacnlee 回复

看 #1 Rei 的回复里的链接,里面有解释 1.0.x 的 OpenSSL 会遇到这个问题。

roostinghawk 回复

UpYun 提供的能力,他们的免费 SSL 证书目前看没其他选择,有个 TrustAsia DV SSL 单域名证书,我试试

清华源也是 lets encrypt 的,就新了 20 天,是不是有什么不同?

Rei 回复

openssl s_client -showcerts -connect mirrors.tuna.tsinghua.edu.cn:443 -servername mirrors.tuna.tsinghua.edu.cn | grep "certificate has expired"

depth=3 O = Digital Signature Trust Co., CN = DST Root CA X3
verify error:num=10:certificate has expired
notAfter=Sep 30 14:01:15 2021 GMT
    Verify return code: 10 (certificate has expired)

实际上清华源也是根证书过期,但是不清楚为什么能用(

已经更新成 TrustAsia 了,大家试试

huacnlee 回复

感谢大佬,已经可以 bundle install 了

需要 登录 后方可回复, 如果你还没有账号请 注册新账号