SSL_connect 返回=1 errno=0 状态=SSLv3 读取服务器证书 B：证书验证失败
我使用 Authlogic-Connect 进行第三方登录。运行适当的迁移后，Twitter/Google/yahoo 登录似乎工作正常，但 facebook 登录抛出异常：
SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed
开发日志显示
OpenSSL::SSL::SSLError (SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed):
app/controllers/users_controller.rb:37:in `update'
Please suggest..
I am using Authlogic-Connect for third party logins. After running appropriate migrations, Twitter/Google/yahoo logins seem to work fine but the facebook login throws exception:
SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed
The dev log shows
OpenSSL::SSL::SSLError (SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed):
app/controllers/users_controller.rb:37:in `update'
Please suggest..
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（30）
One liner 在管理员提示符
choco install wget中修复了 Windows 的问题（首先参见 chocolatey.org)或者只是这样做：
Milanio 的方法：
A one liner fixes it for Windows in an Admin prompt
choco install wget(first see chocolatey.org)Or just do this:
Milanio's method:
嗯，这对我有用
我的 ubuntu 12.04 的 openssl 实现出了问题
Well this worked for me
Something is wrong with openssl implementation of my ubuntu 12.04
虽然知道这是一个相当蹩脚的解决方案，但我仍然分享这个，因为似乎很少有人在这里回答使用 Windows，而且我认为一些 Windows 用户（包括我）会欣赏一个简单直观的解决方案方法。
这告诉你 openssl 在哪里寻找证书文件。我的名字不是 Luis，但我的名字是
C:/Users/Luis/Code/luislavena/knap-build/var/knapsack/software/x86-windows/openssl/1.0.0l/ssl/cert.pem.根据各自的环境，路径可能会有所不同（例如openknapsack而不是luislavena）。即使在通过控制台
设置 SSL_CERT_FILE=C:\foo\bar\baz\cert.pem之后，路径也没有改变，所以...我创建了目录 < code>C:\Users\Luis\Code\luislavena\knap-build\var\knapsack\software\x86-windows\openssl\1.0.0l\ssl 在我的本地磁盘中，并将证书文件放入其中。尽管很蹩脚，但这肯定会起作用。
While knowing it's rather a lame solution, I'm still sharing this because it seems like very few people answering here use Windows, and I think some of Windows users (me included) would appreciate a simple and intuitive approach.
That tells where your openssl is looking for the cert file. My name is not Luis, but mine was
C:/Users/Luis/Code/luislavena/knap-build/var/knapsack/software/x86-windows/openssl/1.0.0l/ssl/cert.pem. The path may be different depending on each own environments (e.g.openknapsackinstead ofluislavena).The path didn't change even after
set SSL_CERT_FILE=C:\foo\bar\baz\cert.pemvia the console, so... I created the directoryC:\Users\Luis\Code\luislavena\knap-build\var\knapsack\software\x86-windows\openssl\1.0.0l\sslin my local disk and put a cert file into it.Lame as it is, this will surely work.
我尝试使用
brew安装curl-ca-bundle，但该软件包不再可用：在 Mac 上对我有用的解决方案是：
将此行添加到您的
~/.bash_profile（或 zsh 的~/.zshrc）：然后更新您的终端：
I've try install
curl-ca-bundlewithbrew, but the package is no available more:The solution that worked to me on Mac was:
Add this line in your
~/.bash_profile(or~/.zshrcfor zsh):Then update your terminal:
我在处理 Ruby 项目时遇到了同样的问题。我使用的是 Windows 7 64 位。
我通过以下方式解决了这个问题：
源：https://gist.github.com/fnichol/867550
I had this same issue while working on a Ruby project. I am using Windows 7 64bit.
I resolved this by:
source: https://gist.github.com/fnichol/867550
对我有用的最直接的答案是这个
瞧！
The most straightforward answer which worked for me was this
And voila!!!
带 Homebrew 的 OS X 10.8.x：
OS X 10.8.x with Homebrew:
然后，正如这篇博文所建议的，
“如何解决 Net::HTTP 的有风险的默认 HTTPS 行为”，
您可能需要安装
always_verify_ssl_certificatesgem，它允许您为ca_file设置默认值。Then, as this blog post suggests,
"How to Cure Net::HTTP’s Risky Default HTTPS Behavior"
you might want to install the
always_verify_ssl_certificatesgem that allow you to set a default value forca_file.这对我有用。如果您使用rvm和brew：
This worked for me. If you using rvm and brew:
我遇到了这个问题，尽管我是 OSX 上的 RVM 用户，但建议的
rvm osx-ssl-certs update all修复不起作用。对我有用的修复是重新安装最新版本的 openssl：
I ran into this issue and the suggested fix of
rvm osx-ssl-certs update alldid not work despite that I am an RVM user on OSX.The fix that worked for me was re-installing the latest version of openssl:
我通过在终端中运行它解决了这个问题。完整文章可通过此处获取
I fixed this problem by running this in terminal. Full writeup is available over here
OSX解决方案：
安装最新的rvm稳定版本
使用rvm命令自动解决证书
OSX solution:
install latest rvm stable version
use rvm command to solve the certificates automatically
如果您在本地运行 Rails 应用程序，则只需在 application.rb 的底部添加此行即可。
之后您就可以毫无问题地使用该应用程序。您可以称其为 hack，但不建议这样做。仅当需要本地运行时使用
If you are running your rails app locally then just add this line at the bottom of application.rb.
After this you can use the app without any issues. You may call it a hack but it is not recommended. Use only when you need to run locally
如果您在 Leopard 上遇到问题，以下是我所做的，对您有帮助。
我的证书很旧，需要更新。我下载了这个：
http://curl.haxx.se/ca/cacert.pem
然后替换我在 Leopard 上找到的证书：
重新加载正在访问它的任何内容，您应该可以开始了！
Here's what I did that helped if you are specifically having a problem on Leopard.
My cert was old and needed to be updated. I downloaded this:
http://curl.haxx.se/ca/cacert.pem
Then replaced my cert which was found here on Leopard:
Reload whatever you have that's accessing it and you should be good to go!
只是因为说明对我有用，所以我想添加我的 2 美分：
我在 OS X Lion 上并使用 macports 和 rvm
我安装了curl-ca-bundle：
然后我将omniauth配置调整为这：
Just because instructions were a slight bit different for what worked for me, I thought I add my 2 cents:
I'm on OS X Lion and using macports and rvm
I installed curl-ca-bundle:
Then I adjusted my omniauth config to be this:
如果 /usr/local/etc/openssl 中有指向 cert.pem 的符号链接，请尝试执行以下操作：
If you have a symbolic link in the /usr/local/etc/openssl pointing to cert.pem try to do this:
对我有用的是答案的组合，即：
What worked for me is a combination of answers, namely:
我遇到了好几天的麻烦，一直在到处乱搞。 此链接 事实证明对我非常有帮助。它帮助我在 MAC OS X 9 上成功升级 SSL。
I had trouble for a number of days and was hacking around. This link proved out to be extremely helpful for me. It helped me to do a successful upgrade of the SSL on MAC OS X 9.
有时并不总是rvm的问题
在MAC OSX中，如果删除.rvm，问题仍然存在（特别是当您从时间机器备份数据时），您可以尝试这种方法。
Sometime it's not always rvm's problem
in MAC OSX,if you remove .rvm,the problem still(espcially while you backup data from timemachine) ,you can try this way.
添加
gem '已认证', '~>; 1.0'到我的Gemfile并运行bundle为我解决了这个问题。Adding
gem 'certified', '~> 1.0'to myGemfileand runningbundlesolved this issue for me.当我尝试使用 Rails 3 的 JQuery 生成器时，我遇到了类似的问题，
我这样解决了：
获取 CURL 证书颁发机构 (CA) 捆绑包。您可以使用以下方法执行此操作：
sudo port install curl-ca-bundle[如果您使用的是 MacPorts]wget http://curl.haxx.se/ca/cacert.pem执行尝试验证 SSL 证书的 ruby 代码：
SSL_CERT_FILE=/ opt/local/etc/certs/cacert.pem Rails 生成 jquery:install。在您的情况下，您想要将其设置为服务器拾取它的环境变量，或者添加类似ENV['SSL_CERT_FILE'] = /path/to/your/new/cacert.pem在您的environment.rb 文件中。您也可以将 CA 文件（我没有尝试过）安装到操作系统 - 这里有冗长的说明 ——这应该以类似的方式工作，但我个人还没有尝试过。
基本上，您遇到的问题是某些 Web 服务使用针对 OpenSSL 无法验证的 CA 签名的证书进行响应。
I ran into a similar problem when trying to use the JQuery generator for Rails 3
I solved it like this:
Get the CURL Certificate Authority (CA) bundle. You can do this with:
sudo port install curl-ca-bundle[if you are using MacPorts]wget http://curl.haxx.se/ca/cacert.pemExecute the ruby code that is trying to verify the SSL certification:
SSL_CERT_FILE=/opt/local/etc/certs/cacert.pem rails generate jquery:install. In your case, you want to either set this as an environment variable somewhere the server picks it up or add something likeENV['SSL_CERT_FILE'] = /path/to/your/new/cacert.pemin your environment.rb file.You can also just install the CA files (I haven't tried this) to the OS -- there are lengthy instructions here -- this should work in a similar fashion, but I have not tried this personally.
Basically, the issue you are hitting is that some web service is responding with a certificate signed against a CA that OpenSSL cannot verify.
如果您在 OS X 上使用 RVM，则可能需要运行此命令：
更多信息请参见： http://rvm.io/support/fixing-broken-ssl-certificates
这是完整的解释：https://github.com/wayneeseguin/rvm/blob/master/help/osx-ssl-certs.md
在 Ruby 2.2 上更新
，您可能需要从源代码重新安装 Ruby 才能解决此问题。操作方法如下（将
2.2.3替换为您的 Ruby 版本）：归功于 https://stackoverflow.com/ a/32363597/4353 和 伊恩·康纳。
If you're using RVM on OS X, you probably need to run this:
More information here: http://rvm.io/support/fixing-broken-ssl-certificates
And here is the full explanation: https://github.com/wayneeseguin/rvm/blob/master/help/osx-ssl-certs.md
Update
On Ruby 2.2, you may have to reinstall Ruby from source to fix this. Here's how (replace
2.2.3with your Ruby version):Credit to https://stackoverflow.com/a/32363597/4353 and Ian Connor.
以下是在 Windows 上修复此问题的方法：https://gist.github.com/867550（由弗莱彻·尼科尔（Fletcher Nichol）
摘录：
Here's how you can fix it on Windows: https://gist.github.com/867550 (created by Fletcher Nichol)
Excerpt:
Ruby 找不到任何可信任的根证书。
查看此博客文章以获取解决方案：“Ruby 1.9 和 SSL 错误"。
Ruby can't find any root certificates to trust.
Take a look at this blog post for a solution: "Ruby 1.9 and the SSL error".
在 OSX 上出现此错误的原因是 rvm 安装的 ruby。
如果您在 OSX 上遇到此问题，您可以在此博客文章中找到对此问题的广泛解释：
http://toadle.me/2015/04/16/fixing-failing-ssl-verification-with-rvm.html
简短的版本是，对于某些在 Ruby 版本中，RVM 下载预编译的二进制文件，这些二进制文件会在错误的位置查找证书。通过强制 RVM 下载源代码并在您自己的计算机上进行编译，您可以确保证书位置的配置正确。
执行此操作的命令是：
如果您已经有相关版本，则可以使用以下命令重新安装它：（
显然，根据需要替换您的 ruby 版本）。
The reason that you get this error on OSX is the rvm-installed ruby.
If you run into this issue on OSX you can find a really broad explanation of it in this blog post:
http://toadle.me/2015/04/16/fixing-failing-ssl-verification-with-rvm.html
The short version is that, for some versions of Ruby, RVM downloads pre-compiled binaries, which look for certificates in the wrong location. By forcing RVM to download the source and compile on your own machine, you ensure that the configuration for the certificate location is correct.
The command to do this is:
if you already have the version in question, you can re-install it with:
(obviously, substitute your ruby version as needed).
问题是 ruby 找不到可信任的根证书。从 1.9 ruby 开始检查这一点。您需要确保您的系统上有 pem 文件形式的curl 证书。您还需要确保证书位于 ruby 期望的位置。您可以在以下位置获取此证书...
如果您是 RVM 和 OSX 用户，那么您的证书文件位置将根据您使用的 ruby 版本而有所不同。使用 :ca_path 显式设置路径是一个坏主意，因为您的代码在投入生产时将不可移植。您想在默认位置为 ruby 提供证书（并假设您的开发人员知道他们在做什么）。您可以使用 dtruss 找出系统在哪里寻找证书文件。
就我而言，系统正在寻找证书文件，
但是 MACOSX 系统需要证书，
我将下载的证书复制到此路径并且它有效。华泰
The issue is that ruby can not find a root certificate to trust. As of 1.9 ruby checks this. You will need to make sure that you have the curl certificate on your system in the form of a pem file. You will also need to make sure that the certificate is in the location that ruby expects it to be. You can get this certificate at...
If your a RVM and OSX user then your certificate file location will vary based on what version of ruby your using. Setting the path explicitly with :ca_path is a BAD idea as your code will not be portable when it gets to production. There for you want to provide ruby with a certificate in the default location(and assume your dev ops guys know what they are doing). You can use dtruss to work out where the system is looking for the certificate file.
In my case the system was looking for the cert file in
however MACOSX system would expect a certificate in
I copied the downloaded cert to this path and it worked. HTH
新的认证 gem 旨在解决此问题：
https://github.com/stevegraham/certified
The new certified gem is designed to fix this:
https://github.com/stevegraham/certified
只需在您的 gemfile 中添加 gem 'certified' 并运行捆绑安装即可。
Just add gem 'certified' in your gemfile and run bundle install.
在具有最新 macport 的 Mac OS X Lion 上：
然后，重新运行失败的作业。
请注意，自 Eric G 于 5 月 12 日答复以来，证书文件位置似乎已发生变化。
On Mac OS X Lion with the latest macport:
Then, rerun the failed job.
Note, the cert file location seems to have changed since Eric G answered on May 12.
这是用于调试目的的另一个选项。
请确保永远不要在任何生产环境中使用它，因为它首先会抵消使用 SSL 的好处。仅在本地开发环境中执行此操作才有效。
Here's another option for debugging purposes.
Be sure never to use this in any production environment, as it will negate benefits of using SSL in the first place. It is only ever valid to do this in your local development environment.