OpenSSL::SSL::SSLError: certificate verify failed (Ruby) Ruby / Rails Origin: Application & API OSI layer 6 · Presentation Last updated 5 Nov 2026

Ruby: OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate)

Ruby's HTTP client (Net::HTTP, Faraday, gem install) couldn't verify the server's certificate.

Exact message you may see OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate)OpenSSL::SSL::SSLError (SSL_connect returned=1 errno=0 state=error: certificate verify failed (self-signed certificate in certificate chain))SSL_connect returned=1 errno=0 state=error: certificate verify failedERROR: SSL verification error at depth 0: unable to get local issuer certificate (20) rubygemsFaraday::SSLError: SSL_connect returned=1
Explore the map of this error Full error map →
Seen on: Ruby SSL

Meaning

Update the CA bundle (brew install ca-certificates, apt install ca-certificates), reinstall Ruby linked to a current OpenSSL, set SSL_CERT_FILE to a valid bundle (e.g. $(brew --prefix)/etc/ca-certificates/cert.pem), or add the corporate root CA. Never set VERIFY_NONE in production. gem install failures on old Ruby need updated rubygems/certs.

Common causes

  • Outdated CA bundle / old Ruby+OpenSSL
  • Corporate TLS inspection root missing
  • Server sends an incomplete chain
  • SSL_CERT_FILE/SSL_CERT_DIR pointing nowhere
  • rbenv/rvm Ruby built against missing OpenSSL

⚡ Quick fix

  1. Update ca-certificates and set SSL_CERT_FILE
  2. Rebuild Ruby with a current OpenSSL (RUBY_CONFIGURE_OPTS="--with-openssl-dir=$(brew --prefix openssl@3)" rbenv install 3.3.0)
  3. Provide the corporate CA via SSL_CERT_FILE

Detailed fix by platform

Ruby

  1. ruby -ropenssl -e 'puts OpenSSL::OPENSSL_LIBRARY_VERSION; puts OpenSSL::X509::DEFAULT_CERT_FILE'

How to diagnose

  1. CA bundle — Current?
  2. OpenSSL — Ruby build?
  3. Proxy — TLS inspection?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Application & API. Errors that are often confused with or caused by this one (click to open):

ArgumentError: missing keyword / unknown keyword — Ruby: ArgumentError: missing keyword: :name / unknown keyword: :nmae (Ruby / Rails)ArgumentError: missin…ArgumentError: wrong number of arguments (given 1, expected 2) — Ruby: ArgumentError: wrong number of arguments (given 1, expected 2..3) (Ruby / Rails)ArgumentError: wrong …Bundler could not find compatible versions for gem — Bundler: Bundler could not find compatible versions for gem "activesupport": In Gemfile: rails (= 7.1.0) depends on activesupport (= 7.1.0) (Ruby / Rails)Bundler could not fin…Bundler: Could not find gem in locally installed gems — Bundler: Could not find gem 'rails (~> 7.1)' in locally installed gems / Could not find rails-7.1.0 in any of the gem sources listed in your Gemfile (Ruby / Rails)Bundler: Could not fi…curl: (60) SSL certificate problem — curl: (60) SSL certificate problem: unable to get local issuer certificate (SSL / TLS)curl: (60) SSL certif…incomplete certificate chain — SSL Labs: Chain issues: Incomplete — Extra download (intermediate certificate missing) (SSL / TLS)incomplete certificat…unable to get local issuer certificate — OpenSSL: error:num=20:unable to get local issuer certificate / SSL: CERTIFICATE_VERIFY_FAILED (SSL / TLS)unable to get local i…OpenSSL::…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.