Can't complete upgrade to Rails 5 because of SSL certificate

Asked 23/1, 2017 at 13:37 Answered 27/11, 2019 at 12:30

Solved ruby ssl rubygems ruby-on-rails-5

I've been at this upgrade for multiple hours now and am finally truly stuck. It all started when I received the typical Bundler::Fetcher::CertificateFailureError. After much tinkering I think I have everything upgraded to the most current version

$ gem -v
2.6.9

$ ruby -v
ruby 2.3.3p222 (2016-11-21 revision 56859) [i386-mingw32]

$ bundle -v
Bundler version 1.14.2

At some point I changed my gem source with

$ gem sources --remove http://rubygems.org
$ gem sources --add http://rubygems.org

I've also changed my Gemfile to http

When I run `bundle install' I get the following error (note, I had to manually break the bit.ly url to post the content of the error)

Fetching source index from https://rails-assets.org/

Retrying fetcher due to error (2/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://rails-assets.org/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see http://bit. ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
Retrying fetcher due to error (3/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://rails-assets.org/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see http://bit. ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
Retrying fetcher due to error (4/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://rails-assets.org/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see http://bit. ly/ruby-ssl. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.
Could not verify the SSL certificate for https://rails-assets.org/.
There is a chance you are experiencing a man-in-the-middle attack, but most
likely your system doesn't have the CA certificates needed for verification. For
information about OpenSSL certificates, see http://bit. ly/ruby-ssl. To connect
without using SSL, edit your Gemfile sources and change 'https' to 'http'.
enter code here

So I'm right back where I started from. On a side note, I'm now getting another error when I try to https: to my gem sources but that might be better as a different question after I get this one taken care of.

Hillis answered 23/1, 2017 at 13:37 Comment(0)

Try changing the rails-assets source to http://insecure.rails-assets.org/
It might be caused by RubyGems' move from SHA-1 to SHA-2. Here's a helpful guide on their website on how to fix the issue

If that and the guides in the bitly didn't fix it, you might have to reinstall. I've encountered this before and nothing seemed to work even after ensuring that my certificates were up to date; luckily, a reinstall seemed to fix it.

Morphophonemics answered 23/1, 2017 at 23:17 Comment(3)

@cristobal - I've already been through the automatic section of of that guide (adjusting for the newer version than the one listed in that guide (but haven't worked with through the manual section of it. Where else would I look to change the rails-assets? My gem sources and Gemfile both use rubygems.org. – Hillis 24/1, 2017 at 1:21

Are you using RailsInstaller? It seems that it had a problem with this and you might have to manually update your cacert (I did that but it didn't work for me; but installing an updated version of Bitnami Rubystack did) I found a similar question – Morphophonemics 24/1, 2017 at 2:38

Now I'm feeling very thick headed. ;) I moved my code to another working windows machine and ended up discovering that the "mystery' rails-assets.org was actually from a line in my Gemfile. I never understood that bundle was actually getting into that file before it crashed. Changing to insecure.rails-assets like @cristobal suggest did the trick. – Hillis 24/1, 2017 at 14:59

You can update the openssl package

Coracle answered 27/11, 2019 at 12:30 Comment(0)

Recommended topics

Hot tags