Google-api-ruby-client: Receive "certificate verify failed" when running client.authorization.fetch_access_token! on Mac

[jeremyhaile]

I'm on Mac OS X Yosemite 10.10.3

The full error message is:

Faraday::SSLError: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed
from ruby/2.2.0/net/http.rb:923:in `connect'

Things I've tried:

1. Updating to the latest google-api-client (0.8.6)
2. Updating OpenSSL using homebrew and force relinking it (stable 1.0.2a-1)
3. Running rvm osx-ssl-certs update all
4. Checking that rvm osx-ssl-certs status all says "Up to date" for all pem files (it does)
5. Downloading a new pem file from curl.haxx.se/ca/cacert.pem and then using the ca_file option to reference that pem file
6. Out of desperation, I tried running client.connection.ssl.verify = false but this still doesn't work. Perhaps faraday is initialized prior to me running this, and so ignores it?

I've read a ton of stack overflows, searched forums, searched issues on the project. Everything I try still results in a "certificate verify failed" when running fetch_access_token!

This error does not occur when I use an existing oauth2 access_token and make an API request.

[spikex]

I can confirm this issue. I've tried all of the above as well.

I've worked around this by explicitly loading openssl first (in my case before Bundler.require) and setting verify to none:

require 'openssl'
OpenSSL::SSL::VERIFY_PEER = OpenSSL::SSL::VERIFY_NONE

This is not a good idea, but I haven't found a real fix yet.

[jeremyhaile]

@spikex I confirmed that your workaround does get rid of this error, although it is obviously not secure or ideal.

[sqrrrl]

Yeah, don't do that :)

Just pushed a new version of signet (0.6.1) which hopefully fixes this. Other workarounds:

• Set the environment variable SSL_CERT_FILE to the path of the PEM file
• Override the faraday connection with the one from the api client. Something like the following should work

api_client = Google::APIClient.new
# ...
api_client.authorization.fetch_access_token!(:connection => api_client.connection)

[spikex]

I ran bundle update signet to get 0.6.1. It appears to be setting up the environment correctly:

2.1.5 :001 > ENV['SSL_CERT_FILE']
 => nil
2.1.5 :002 > require 'signet'
 => true
2.1.5 :003 > require 'signet/oauth_2.rb'
 => true
2.1.5 :004 > ENV['SSL_CERT_FILE']
 => "/usr/local/etc/openssl/cert.pem"

However, I still get the verification error. Likewise if I set SSL_CERT_FILE to either /usr/local/etc/openssl/cert.pem (Homebrew) /etc/openssl/cert.pem (system).

Reusing the api_client.connection does work.

[sqrrrl]

@spikex FWIW, I was able to reproduce with a clean 2.2.2 install. Setting the SSL_CERT_FILE did work for me, but not with every ca bundle. The one included here (under lib/cacerts.pem) contains valid roots for Google. It's possible that the bundle you used was missing something.

[spikex]

Thanks, must be the the Mac (or my Mac anyway) doesn't have what it needs, even with the help of Home Brew.

[jeremyhaile]

FWIW, I switched to just using Typhoeus to hit Google's API directly and now I'm having no trouble at all... I gave up on the gem.

[przbadu]

Thank you very much for saving my day #sqrrrl solution worked for me :+1:

[fletchrichman]

Had this issue too, had all the same issues as @spikex and had to download the cert file from lib/cacerts.pem and replace my local one. apparently this is the only valid cert file, not the ones from brew or rvm.

[dblommesteijn]

@fletchrichman Same here it seems to be a Yosemite problem, solved by downloading this http://curl.haxx.se/ca/cacert.pem, and saving it replacing /usr/local/etc/openssl/cert.pem. I've added export SSL_CERT_FILE=/usr/local/etc/openssl/cert.pem to my .bash_profile.

[crosspass]

@dblommesteijn adopt you method, and all ok，thank you very much!

[torick]

Guys Still the problem with rails , Gem::RemoteFetcher::FetchError: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed (https://rubygems.org/gems/rake-10.5.0.gem)
An error occurred while installing rake (10.5.0), and Bundler cannot continue.
Make sure that gem install rake -v '10.5.0' succeeds before bundling.
Any solutions on to Windows?

[cruznunez]

I'm getting this error on Windows:

Faraday::SSLError SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed

I got a similar problem when using Facebook OmniAuth gem. Downloaded the cacert.pem file and pointed ENV['SSL_CERT_FILE'] to that file.

That fixed my Facebook OAuth error.

Then I tried adding Google OAuth. I got the same error as before.

Facebook and Twitter are working for me, but I get the Faraday error when I try authorizing through Google.

Using faraday 0.9.2
Using omniauth 1.3.1
Using omniauth-oauth2 1.4.0
Using omniauth-facebook 3.0.0
Using omniauth-google-oauth2 0.3.1
Using omniauth-oauth 1.1.0
Using omniauth-twitter 1.2.1

Any suggestions? Why would it work for one, but not the other?

[dblommesteijn]

@cruznunez are you using RVM? I had the same issues, but have switched to rbenv. Perhaps reinstalling rvm with rubies works.

[cruznunez]

@dblommesteijn I am not using RVM.

[Antol]

Same here

[mtwilliams]

Still getting this, even after updating my CA bundle.

[Antol]

I had trying everything that I found in internet. Only thing that fixed it is removing rvm and install rbenv

[bobzhen]

gem install rake -v '10.5.0' before bundle install works for me! Thanks!

[illtellyoulater]

Getting the same error here on Windows! This is a nightmare!

[zegomesjf]

I have this problem today and fix reinstalling ruby using
rvm reinstall ruby-2.1.5 --with-openssl-dir=/usr/local

[Ashkin]

I'm also having this problem on Windows.

Update: Solved by updating RubyGems (from 2.5.1 to 2.6.7)

[csaden]

I faced the same error (on Mac OSX 10.10.5 Yosemite).

ERROR:  While executing gem ... (Gem::RemoteFetcher::FetchError)
    SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed (https://api.rubygems.org/specs.4.8.gz)

I deleted rvm and and re-installed but still faced the same problem. I could not brew link --force openssl and ended up stumbling upon this for the solution.

rvm install 2.2.4 --disable-binary
Install whatever ruby version you need.

http://stackoverflow.com/a/18344044/4830231

[przbadu]

I am on yosemite, I had to do:

brew update
brew remove openssl
brew install openssl
brew link openssl
rvm reinstall 2.3.1 --disable-binary

http://railsapps.github.io/openssl-certificate-verify-failed.html, looks like outdated to me because, curl-ca-bundle is no more availabe as brew formula neither did raggi/ale worked for me.

[vchinthakunta]

Try this if you are Windows 10.. worked for me!
https://gist.github.com/eyecatchup/20a494dff3094059d71d

[tbolt]

Restarting my machine solved this issue for me. I would start there.

macOS Sierra 10.12.3

[monkeysuffrage]

I solved this with certified gem,

[xhuang97]

@dblommesteijn Replacing cert.pem file solution works on OS X El Capitan 10.11.6 as well

[alexismansilla]

Thx @spikex

[randhawp]

Check your system time, it should be approx equal to the server time.