SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed

Question

I am using Authlogic-Connect for third party logins. After running appropriate migrations, Twitter/Google/yahoo logins seem to work fine but the facebook login throws except

Answer 1

The new certified gem is designed to fix this:

https://github.com/stevegraham/certified

Answer 2

The most straightforward answer which worked for me was this

sudo apt-get install openssl ca-certificates

And voila!!!

Answer 3

I had trouble for a number of days and was hacking around. This link proved out to be extremely helpful for me. It helped me to do a successful upgrade of the SSL on MAC OS X 9.

Answer 4

If you are running your rails app locally then just add this line at the bottom of application.rb.

OpenSSL::SSL::VERIFY_PEER = OpenSSL::SSL::VERIFY_NONE

After this you can use the app without any issues. You may call it a hack but it is not recommended. Use only when you need to run locally

Answer 5

Here's what I did that helped if you are specifically having a problem on Leopard.

My cert was old and needed to be updated. I downloaded this:

http://curl.haxx.se/ca/cacert.pem

Then replaced my cert which was found here on Leopard:

/usr/share/curl/curl-ca-bundle.crt

Reload whatever you have that's accessing it and you should be good to go!

Answer 6

I ran into a similar problem when trying to use the JQuery generator for Rails 3

I solved it like this:

1. Get the CURL Certificate Authority (CA) bundle. You can do this with:

   • sudo port install curl-ca-bundle [if you are using MacPorts]
   • or just pull it down directly wget http://curl.haxx.se/ca/cacert.pem

2. Execute the ruby code that is trying to verify the SSL certification: SSL_CERT_FILE=/opt/local/etc/certs/cacert.pem rails generate jquery:install. In your case, you want to either set this as an environment variable somewhere the server picks it up or add something like ENV['SSL_CERT_FILE'] = /path/to/your/new/cacert.pem in your environment.rb file.

You can also just install the CA files (I haven't tried this) to the OS -- there are lengthy instructions here -- this should work in a similar fashion, but I have not tried this personally.

Basically, the issue you are hitting is that some web service is responding with a certificate signed against a CA that OpenSSL cannot verify.