certificate verify failed (unable to get certificate CRL) (OpenSSL::SSL::SSLError)

The following example fails after installing "OpenSSL 3.6.0":

require 'net/http'
require 'uri'

uri = URI('https://example.com')

# Creating a POST request, which is a subclass of Net::HTTPGenericRequest
request = Net::HTTP::Post.new(uri)

# Sending the request
Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  response = http.request(request)
  puts response.body
end

With the following error:

/Users/[user]/.local/share/mise/installs/ruby/3.4.6/lib/ruby/3.4.0/net/protocol.rb:46:in 'OpenSSL::SSL::SSLSocket#connect_nonblock': SSL_connect returned=1 errno=0 peeraddr=[2600:1406:5e00:6::17ce:bc12]:443 state=error: certificate verify failed (unable to get certificate CRL) (OpenSSL::SSL::SSLError)
        from /Users/bfolkens/.local/share/mise/installs/ruby/3.4.6/lib/ruby/3.4.0/net/protocol.rb:46:in 'Net::Protocol#ssl_socket_connect'
        from /Users/bfolkens/.local/share/mise/installs/ruby/3.4.6/lib/ruby/3.4.0/net/http.rb:1736:in 'Net::HTTP#connect'
        from /Users/bfolkens/.local/share/mise/installs/ruby/3.4.6/lib/ruby/3.4.0/net/http.rb:1636:in 'Net::HTTP#do_start'
        from /Users/bfolkens/.local/share/mise/installs/ruby/3.4.6/lib/ruby/3.4.0/net/http.rb:1625:in 'Net::HTTP#start'
        from /Users/bfolkens/.local/share/mise/installs/ruby/3.4.6/lib/ruby/3.4.0/net/http.rb:1064:in 'Net::HTTP.start'
        from test.rb:10:in '<main>'

bundle doctor --ssl fails with:

The Gemfile's dependencies are satisfied
Here's your OpenSSL environment:

OpenSSL:       3.3.0
Compiled with: OpenSSL 3.6.0 1 Oct 2025
Loaded with:   OpenSSL 3.6.0 1 Oct 2025

Trying connections to https://rubygems.org:
Bundler:       success
RubyGems:      success
Ruby net/http: failed

Unfortunately, this Ruby can't connect to rubygems.org.

Below affect only Ruby net/http connections:
SSL_CERT_FILE: exists     /opt/homebrew/etc/openssl@3/cert.pem
SSL_CERT_DIR:  exists     /opt/homebrew/etc/openssl@3/certs

Your Ruby can't connect to rubygems.org because you are missing the certificate files OpenSSL needs to verify you are connecting to the genuine rubygems.org servers.

No issues found with the installed bundle

Same here. It looks like DEFAULT_CERT_STORE is initialized empty, so Ruby cannot verify any SSL connections. I found this temporary workaround:

Create ~/.rubyopenssl_default_store.rb:

require "openssl"
s = OpenSSL::X509::Store.new.tap(&:set_default_paths)
OpenSSL::SSL::SSLContext.send(:remove_const, :DEFAULT_CERT_STORE) rescue nil
OpenSSL::SSL::SSLContext.const_set(:DEFAULT_CERT_STORE, s.freeze)

Load it for all Ruby processes, e.g. in your shell config:

export RUBYOPT="-r$HOME/.rubyopenssl_default_store.rb $RUBYOPT"

Thanks for your report.

OpenSSL::SSL::SSLContext#set_params uses the default cert store with the OpenSSL::X509::V_FLAG_CRL_CHECK_ALL flag (and no other flags):

openssl/lib/openssl/ssl.rb

Lines 92 to 94 in 7f4886b

    
           DEFAULT_CERT_STORE = OpenSSL::X509::Store.new # :nodoc: 
        
           DEFAULT_CERT_STORE.set_default_paths 
        
           DEFAULT_CERT_STORE.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL

OpenSSL 3.6.0 appears to have changed the behavior in commit openssl/openssl@b1b4b15, which doesn't look intentional.

At the same time, ruby/openssl shouldn't set that flag by default. It previously had no effect, according to the man page for X509_VERIFY_PARAM_set_flags():

X509_V_FLAG_CRL_CHECK_ALL expands CRL checking to the entire certificate chain if X509_V_FLAG_CRL_CHECK has also been enabled, and is otherwise ignored.

@ledermann

Same here. It looks like DEFAULT_CERT_STORE is initialized empty, so Ruby cannot verify any SSL connections. I found this temporary workaround:

Create ~/.rubyopenssl_default_store.rb:
require "openssl"
s = OpenSSL::X509::Store.new.tap(&:set_default_paths)
OpenSSL::SSL::SSLContext.send(:remove_const, :DEFAULT_CERT_STORE) rescue nil
OpenSSL::SSL::SSLContext.const_set(:DEFAULT_CERT_STORE, s.freeze)

Load it for all Ruby processes, e.g. in your shell config:
export RUBYOPT="-r$HOME/.rubyopenssl_default_store.rb $RUBYOPT"

Thank you @ledermann !! this worked

Thanks @rhenium for digging into this

ssl: remove OpenSSL::X509::V_FLAG_CRL_CHECK_ALL from the default store

@rhenium

Thanks @rhenium 🙏

I've pushed v3.1.2, v3.2.2, and v3.3.1 to rubygems.org with the change in #950.

[ruby/openssl] ssl: remove OpenSSL::X509::V_FLAG_CRL_CHECK_ALL from t…

@DucNguyenTHT

@rhenium can you make an update for 3.3.4

@DucNguyenTHT I don't understand what are you talking about. The Ruby OpenSSL (openssl gem) version 3.3.1 was released yesterday for the Ruby OpenSSL 3.3 series. What does the "3.3.4" mean?

Hey, all. 👋

I'm currently using OpenSSL 3.3.1 (latest version release) but still had to apply Ledermann's fix in order for this to work. I'm also using: OpenSSL 3.6.0 1 Oct 2025 (Library: OpenSSL 3.6.0 1 Oct 2025). I was under the impression that 3.3.1 fixed this but maybe not?

@bkuhlmann

@bkuhlmann for me bundle doctor --ssl works after I installed ruby 3.4.5 with openssl 3.6.0 and openssl 3.3.1 gem

❯ bundle doctor --ssl
The Gemfile's dependencies are satisfied
Here's your OpenSSL environment:

OpenSSL:       3.3.1
Compiled with: OpenSSL 3.6.0 1 Oct 2025
Loaded with:   OpenSSL 3.6.0 1 Oct 2025

Trying connections to https://rubygems.org:
Bundler:       success
RubyGems:      success
Ruby net/http: success

Hooray! This Ruby can connect to rubygems.org.
You are all set to use Bundler and RubyGems.

No issues found with the installed bundle

@ledermann

Oddly, while bundle doctor --ssl works without issue after installing openssl v3.3.1, I am still running into this issue during actual application use. @ledermann's temporary patch resolves it just like for @bkuhlmann.

If it helps, I'm running Ruby 3.4.6 via asdf, which has openssl 3.3.0 installed as the default version of the gem. When I start up a Rails console, the activated version of OpenSSL seems to be 3.3.0 rather than 3.3.1.

Hey, all. 👋

I'm currently using OpenSSL 3.3.1 (latest version release) but still had to apply Ledermann's fix in order for this to work. I'm also using: OpenSSL 3.6.0 1 Oct 2025 (Library: OpenSSL 3.6.0 1 Oct 2025). I was under the impression that 3.3.1 fixed this but maybe not?

It's fixed in v3.1.2/v3.2.2/v3.3.1. But you may still be picking up an older release. You can verify it with the OpenSSL::VERSION constant.

A common situation is when your project uses Bundler but openssl isn't listed in the dependency tree. In that case, Bundler will fall back to the original version bundled with Ruby.

I'd recommend adding gem "openssl" to your Gemfile.

FYI, this isn't specific to openssl, but it applies to all "default gems" (which are gradually being converted to bundled gems, and then they always need to be specified explicitly): https://docs.ruby-lang.org/en/master/standard_library_md.html

[ruby/openssl] ssl: remove OpenSSL::X509::V_FLAG_CRL_CHECK_ALL from t…

fix ssl crl error

Pin to image for Ruby

add openssl dep at version new enough to fix ruby/openssl#949

add openssl dep at version new enough to fix ruby/openssl#949 (#6094)

add openssl dep at version new enough to fix ruby/openssl#949 (#195)

add openssl dep at version new enough to fix ruby/openssl#949 (#89)

Account for SSL Error

This fixed that for me: https://www.rubyonmac.dev/certificate-verify-failed-unable-to-get-certificate-crl-openssl-ssl-sslerror

TLDR: gem "openssl", "~> 3.3.1" in your Gemfile

Running on openssl 3.6 installed by homebrew and ruby 3.4.2 via asdf

Want to left here for other folks.
Note ruby MIGHT IGNORE RUBY_CONFIGURE_OPTS on reinstall and will point to 3.6.0
Unless you will explicitly uninstall that version.

What worked for me:

brew install openssl@3.5 &&  \
rbenv uninstall -f 3.1.3 && \
RUBY_CONFIGURE_OPTS="--with-openssl-dir=$(brew --prefix openssl@3.5)" \
rbenv install -f 3.1.3 && \
$HOME/.rbenv/versions/3.1.3/bin/ruby -ropenssl -e 'puts OpenSSL::OPENSSL_VERSION'

@fabn

@fabn thank you for sharing this:

TLDR: gem "openssl", "~> 3.3.1" in your Gemfile

Depending on the version requirements and upgrade strategy you have in your projects, you might consider:

gem 'openssl', '~> 3.3', '>= 3.3.1'

That's because ~> 3.3.1 means >= 3.3.1 and < 3.4.0 so only patch updates will be allowed. To also allow minor updates, we need to use ~> 3.3, followed by >= 3.3.1 to require the patch fix for the OpenSSL issue.

So if you need at least version 3.3.2 but want to continue receiving minor updates (3.4, 3.5, etc.), combining both constraints is the best approach.

This was fixed in openssl yesterday (12/11/25) but not released yet: openssl/openssl@996d50d

I found another workaround/fix in case OpenSSL is installed via Homebrew:

brew rm openssl --ignore-dependencies
rm -rf /opt/homebrew/etc/openssl@3
brew install openssl

Then reinstall Ruby:

mise uninstall ruby@x.x.x
mise install ruby@x.x.x

Navigation Menu

Repository navigation

certificate verify failed (unable to get certificate CRL) (OpenSSL::SSL::SSLError) #949

25 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	DEFAULT_CERT_STORE = OpenSSL::X509::Store.new # :nodoc:
	DEFAULT_CERT_STORE.set_default_paths
	DEFAULT_CERT_STORE.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL

certificate verify failed (unable to get certificate CRL) (OpenSSL::SSL::SSLError) #949

Description

Activity

ledermann commented on Oct 4, 2025

rhenium commented on Oct 4, 2025

bfolkens commented on Oct 4, 2025

miharekar commented on Oct 6, 2025

rhenium commented on Oct 6, 2025

junaruga commented on Oct 7, 2025

bkuhlmann commented on Oct 7, 2025

Aqualon commented on Oct 8, 2025

agrobbin commented on Oct 8, 2025

rhenium commented on Oct 8, 2025

25 remaining items

fabn commented on Nov 19, 2025

ivanglushko commented on Nov 26, 2025

mokagio commented on Dec 5, 2025

jwhitcraft commented on Dec 12, 2025

monai commented on Jan 7, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions