Download a cacert.pem for RailsInstaller

README.md

Why?

There is a long standing issue in Ruby where the net/http library by default does not check the validity of an SSL certificate during a TLS handshake. Rather than deal with the underlying problem (a missing certificate authority, a self-signed certificate, etc.) one tends to see bad hacks everywhere. This can lead to problems down the road.

From what I can see the OpenSSL library that Rails Installer delivers has no certificate authorities defined. So, let's go fetch some from the curl website. And since this is for ruby, why don't we download and install the file with a ruby script?

Installation

The Ruby Way! (Fun)

This assumes your have already installed the Rails Installer for Windows.

Download the ruby script to your Desktop folder from https://gist.github.com/raw/867550/win_fetch_cacerts.rb. Then in your command prompt, execute the ruby script:

ruby "%USERPROFILE%\Desktop\win_fetch_cacerts.rb"

Now make ruby aware of your certificate authority bundle by setting SSL_CERT_FILE. To set this in your current command prompt session, type:

set SSL_CERT_FILE=C:\RailsInstaller\cacert.pem

To make this a permanent setting, add this in your control panel.

The Manual Way (Boring)

Download the cacert.pem file from http://curl.haxx.se/ca/cacert.pem. Save this file to C:\RailsInstaller\cacert.pem.

Now make ruby aware of your certificate authority bundle by setting SSL_CERT_FILE. To set this in your current command prompt session, type:

set SSL_CERT_FILE=C:\RailsInstaller\cacert.pem

To make this a permanent setting, add this in your control panel.

win_fetch_cacerts.rb

require 'net/http'

# create a path to the file "C:\RailsInstaller\cacert.pem"
cacert_file = File.join(%w{c: RailsInstaller cacert.pem})

Net::HTTP.start("curl.haxx.se") do |http|
  resp = http.get("/ca/cacert.pem")
  if resp.code == "200"
    open(cacert_file, "wb") { |file| file.write(resp.body) }
    puts "\n\nA bundle of certificate authorities has been installed to"
    puts "C:\\RailsInstaller\\cacert.pem\n"
    puts "* Please set SSL_CERT_FILE in your current command prompt session with:"
    puts "     set SSL_CERT_FILE=C:\\RailsInstaller\\cacert.pem"
    puts "* To make this a permanent setting, add it to Environment Variables"
    puts "  under Control Panel -> Advanced -> Environment Variables"
  else
    abort "\n\n>>>> A cacert.pem bundle could not be downloaded."
  end
end

This might be a dumb question, I am new to Ruby on Rails programming, but how are you supposed to download script?
Please someone give me an answer. Im getting desperate for help.

the "ruby" way doesn't work

@JohnathanPratt Test in this way without script https://www.youtube.com/watch?v=xg_Zb9vGz-8

This did not work for me. Fortunately, this official workaround worked great :

https://gist.github.com/luislavena/f064211759ee0f806c88

It worked for me....thanks a lot for the solution I was getting the error "SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed" and by trying the above solution my issue got resolved and I was able to install all the gems.

Regards,
Maheswari

It worked for me too...thank you so much...

best regards,
Rogerio

thx andkirby worked for me on windows 10 + git bash

THANK YOU SO MUCH!! So many hacky solutions out there, this one was the only one that was simple and actually worked.

Thank you :-)

Super thank you, it worked for me too on Windows 7. The Ruby way didn't work but the Manual one perfectly, then I changed the environment variable (otherwise every time you reboot you have to set back the variable on the command, so it's more convenient to do it permanently). I had a little hard to do it, I've seen another comment a little up that explains how to do it, but here is back if it can help you :

Go on the Control Panel -> Security system -> System ->Advanced system settings -> Environment Variables -> System Variables :
Here click on New and copy paste for the name : SSL_CERT_FILE, and for the variable : C:\RailsInstaller\cacert.pem (if you did put the cacert.pem at this place like told in this article).
Finally reboot your computer and it should work (I was trying without rebooting and it was not working...)

Enjoy !

Hi,
But the first approach doesn't work , 302 redirection for using http://curl.haxx.se , even with using https with :use_ssl .

The second solution works fine.

Thank you for your work !

I've followed all possible suggestions but one Windows 10 operating system doesn't want to work

C:\>gem --version
2.6.10
C:\>gem which rubygems
C:/tools/ruby23/lib/ruby/site_ruby/2.3.0/rubygems.rb

For the this path I've followed the manual steps on the official guide

Additional to this I tried to SET SSL_CERT_FILE=C:\tools\ruby23\lib\ruby\2.3.0\rubygems\ssl_certs\AddTrustExternalCARoot.pem and still it doesn't work.

My openssl is

ruby -ropenssl -e 'puts OpenSSL::OPENSSL_VERSION'
OpenSSL 1.0.2j  26 Sep 2016

The ruby way not worked. @Doremiska Thank! Reboot helps, after setup environment variable.

@sschwartzman Using Rubymine on windows10, this one works! Thanx so much

Manual method worked for me! I was trying to use Nokogiri gem to download a webpage, but it wouldn't work until I came across this solution - thank you! I use Windows 10 and I only have Ruby 2.2.6 installed.

PS make sure you use follow Doremiska's comment (above) to go into control panel and set an environment variable to point to the cacert.pem file

It solved my problem with Zendesk Application Framework v2 :)

Thank you so much for this solved my SSL issue, was pulling my hair out over this! 💯 👍
Remember to restart your computer after making the changes and follow @Doremiska

None of the suggestions worked for me at all, with the latest RailsInstaller on Windows 10. I used 'gem certified' and followed those instructions. I tried manual ways. I tried updating my PATH, and ruby -ropen-uri -e 'eval open("https://git.io/vQhWq").read'. This appeared to work, but still gave an error in Chrome when accessing my form and submitting it. I don't know if it has anything to do with adding a Google ReCaptcha to my form in my app, which I test on localhost. So I just figured switching to IE Edge might work out because it's "less secure," and it worked. If you're on Windows, try everything you can, then use IE Edge. Maybe it will work out => I mean for development. You will want a proper fix for production of course.

Ruby on Windows 10, setting the env via "Advanced System Settings" worked. setting it in the ruby code, i.e. ENV["SSL_CERT_FILE"] did not.

Ruby on Windows 10, setting the env via "Advanced System Settings" worked. setting it in the ruby code, i.e. ENV["SSL_CERT_FILE"] did not.

This was true for me as well.

Looks like JRuby on Windows ignores SSL_CERT_FILE environment variable.

Thank you !!

Thanks! Did it years ago on my old machine. Forgot about it. Thanks again!

Thank you no longer get the error, these are the steps if anyone wants to follow

1.Install DEVELOPMENT KIT (depending on your version Ruby or Rails) in the path and folder C:\devkit http://rubyinstaller.org/downloads/

2.Through the command prompt to access C:\devkit

3.Paste into the command prompt these commands

ruby dk.rb init

ruby dk.rb install

4.Download this file https://curl.haxx.se/ca/cacert.pem (with Firefox, File - Save as ...) and download in C:\RubyXX (if installed in C:)

5.set SSL_CERT_FILE=C:\RubyXX\cacert.pem (change after the equal sign, the path where cacert.pem was installed, ie in C:\RubyXX)

6.Paste into the command prompt

set SSL_CERT_FILE=C:\RubyXX\cacert.pem

7.Install this gem for devkit

gem install rdiscount --platform=ruby

8.Close the command prompt

9.Add environment variables SSL certificate

Control Panel - Security system - System - Advanced system settings - Environment Variables - System Variables - New - Variable name - (Paste "SSL_CERT_FILE" this without quotes) - Variable value - (Paste the path where cacert.pem was installed "C:\RubyXX\cacert.pem") - OK - OK - OK ;)

10.Try installing another gem

https://www.youtube.com/watch?v=xg_Zb9vGz-8

THANK YOU THANK YOU!!!!! Vicente-M you are my best friend!!!!!