# Ruby: OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate)

**Code:** `OpenSSL::SSL::SSLError: certificate verify failed (Ruby)` · **Category:** Ruby / Rails · **Seen on:** Ruby, SSL

Ruby's HTTP client (Net::HTTP, Faraday, gem install) couldn't verify the server's certificate.

## Meaning

Update the CA bundle (`brew install ca-certificates`, `apt install ca-certificates`), reinstall Ruby linked to a current OpenSSL, set `SSL_CERT_FILE` to a valid bundle (e.g. `$(brew --prefix)/etc/ca-certificates/cert.pem`), or add the corporate root CA. Never set `VERIFY_NONE` in production. `gem install` failures on old Ruby need updated rubygems/certs.

## Common causes

- Outdated CA bundle / old Ruby+OpenSSL
- Corporate TLS inspection root missing
- Server sends an incomplete chain
- SSL_CERT_FILE/SSL_CERT_DIR pointing nowhere
- rbenv/rvm Ruby built against missing OpenSSL

## Quick fix

1. Update `ca-certificates` and set `SSL_CERT_FILE`
2. Rebuild Ruby with a current OpenSSL (`RUBY_CONFIGURE_OPTS="--with-openssl-dir=$(brew --prefix openssl@3)" rbenv install 3.3.0`)
3. Provide the corporate CA via `SSL_CERT_FILE`

## Detailed fix by platform

### Ruby

1. `ruby -ropenssl -e 'puts OpenSSL::OPENSSL_LIBRARY_VERSION; puts OpenSSL::X509::DEFAULT_CERT_FILE'`

## How to diagnose

1. **CA bundle** — Current?
2. **OpenSSL** — Ruby build?
3. **Proxy** — TLS inspection?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/ruby/openssl-sslerror-certificate-verify-failed-ruby)