PayPal SDK got SSL_connect returned=1 errno=0 state=error: certificate verify failed (無法獲得本地頒發者證書)

Question

我在 macOS Catalina v10.15.6 上使用 ruby 2.7.0、Rails 6.0.3.2、paypal-sdk-core 1.7.4 和 OpenSSL 1.1.1d 遇到了這個問題。 當我將代碼部署到 Amazon Linux 2 時，AWS 遇到了同樣的錯誤。 所以，我猜供應商/捆綁包中的某些東西被破壞了。

在我通過 rbenv 卸載和安裝重新安裝 ruby2.7.0 之前，此代碼正在運行。

在以下代碼中執行 Sale.find 時出現異常錯誤。

sale   = Sale.find(ipn.txn_id) refund = sale.refund_request({
                               :amount    => {
                               :total     => refund_amount.to_f,
                               :currency  => ipn.currency_code },
                               :reference => reference
                             })

我檢查了 HTTPS 連接和 SSL 握手看起來不錯。

$ openssl s_client -connect api.sandbox.paypal.com:443
CONNECTED(00000005)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 High Assurance Server CA
verify return:1
depth=0 C = US, ST = California, L = San Jose, O = "PayPal, Inc.", OU = PayPal Production, CN = api.sandbox.paypal.com
verify return:1
---
Certificate chain
 0 s:C = US, ST = California, L = San Jose, O = "PayPal, Inc.", OU = PayPal Production, CN = api.sandbox.paypal.com
   i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 High Assurance Server CA
 1 s:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 High Assurance Server CA
   i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
xxxxxxxxxxxxxxxxxxxxxxxxxxxx
-----END CERTIFICATE-----
subject=C = US, ST = California, L = San Jose, O = "PayPal, Inc.", OU = PayPal Production, CN = api.sandbox.paypal.com

issuer=C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 High Assurance Server CA

---
Acceptable client certificate CA names
C = US, ST = California, L = San Jose, O = "PayPal, Inc.", OU = sandbox_certs, CN = sandbox_camerchapi, emailAddress = re@paypal.com
C = US, ST = California, L = San Jose, O = "PayPal, Inc.", OU = stage1_certs, CN = stage1_camerchapi, emailAddress = re@paypal.com
C = US, ST = CA, L = San Jose, O = PayPal Inc., OU = Mobile Client Certificate Authority, CN = PayPal Sandbox Client CA, emailAddress = DL-PP-ApplicationSecurity@paypal.com
CN = gtorel_1310486522_per_api1.paypal.com, L = Napoli, ST = Napoli, C = IT
CN = Sandbox_RootCA, OU = PayPal Crypto Mgt, O = PayPal Inc., L = San Jose, ST = California, C = US
CN = Sandbox_MerchantIssuingCA, OU = Platform Security, O = PayPal Inc., L = San Jose, ST = California, C = US
Client Certificate Types: RSA sign, DSA sign, ECDSA sign
Requested Signature Algorithms: RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA1:DSA+SHA1:ECDSA+SHA1
Shared Requested Signature Algorithms: RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA1:DSA+SHA1:ECDSA+SHA1
Peer signing digest: SHA256
Peer signature type: RSA
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 4449 bytes and written 462 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: C66CE9265BF19D4A2FB4C4ED43B9C4523FCCA69C09F49BF0E2BBC6E012491463
    Session-ID-ctx: 
    Master-Key: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1596387340
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---

Answer 1

我懷疑刪除對 Verisign G5 根證書的支持是引發此問題的原因。 據推測，需要下載 Root PEM 文件並將其合並到 gem 中。