在 ruby​​ on rails 应用程序中运行 bundle install 时无法验证 SSL 证书错误

Question

I have a ruby on rails app that is throwing an error when I try to run bundle install. The error is the following:

bundle stdout: Could not verify the SSL certificate for https://rails-assets.org/ There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification

Our SSL certificate was updated just a few days ago and we haven't changed anything in the app. It started to throw this error out of the blue.

Is there any chance we need to update the root certificates in the system? I mean like running sudo update-ca-certificates or something like that? is it safe to do that?

The app is in digitalOcean and we use capistrano gem to deploy the app

Answer 1

I checked the certificate of https://rails-assets.org/ , it's signed by LetsEncrypt and one of the Root CA from LetsEncrypt is expired and that would be the cause of your issue.

To understand the issue:

https://www.openssl.org/blog/blog/2021/09/13/LetsEncryptRootCertExpire/ https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/

The possible solution: https://blog.devgenius.io/rhel-centos-7-fix-for-lets-encrypt-change-8af2de587fe4

Basically, if that's the cause, you need to remove the DST Root CA and make sure ISRG Root CA is in your certificate store.