Title: OpenSSL certificate verify failed on Ruby & Windows
Slug: OpenSSL-certificate-verify-failed-on-Ruby-Windows
Date: 2014-09-25 09:10:10
Author: Kartones
Lang: en
Tags: Development, Windows, Ruby, Troubleshooting, Systems-IT
Description: A solution to the OpenSSL certificate verification failure on Ruby and Windows.

 <p>I was just checking a more automated way of <a href="https://github.com/marcelinollano/twitter-purge">cleaning my non-recent Twitter posts</a> when, running the small program, I got hit by an error like:</p> <p><font face="Courier New">OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=...<br>read server certificate ...: certificate verify failed</font></p> <p> </p> <p>If you check around the net, the first solution they say is to add this dangerous line:</p> <p><font face="Courier New">OpenSSL::SSL::VERIFY_PEER = OpenSSL::SSL::VERIFY_NONE</font></p> <p> </p> <p>But, deactivating security is not the best approach, so after some digging I came across <strong>a nice post</strong> (link is dead) that explains the issues, how to debug the specific problem, and partially how to solve it. As I use Windows, the instructions weren't so complete, but it all sums to:</p> <ul> <li>Download a CA certificate bundle, like for example <a href="http://curl.haxx.se/docs/caextract.html">Mozilla's</a></li> <li>Install the .crt file (I installed it for <em>All Users</em>)</li> <li>Setup the following OpenSSL system variables:</li> <ul> <li><em>SSL_CERT_DIR</em>: Point to where you left the CA bundle</li> <li><em>SSL_CERT_FILE</em>: Point to the .pem file</li></ul></ul> <p>Restart your command line, and you should be able to run with SSL peer verification active (as you should).</p>