Rails SSL Certificate Error On Valid Certificate

Encountering an SSL certificate error in your Ruby on Rails application can be frustrating, especially when the certificate is valid. Let’s explore a specific problem scenario and its solution to address SSL certificate errors effectively in Ruby on Rails.

Problem Statement

You have a small Rails app responsible for performing various platform checks and sending email alerts in case of issues. Everything was running smoothly until you started receiving alerts about an SSL certificate error:

def get_request url
 uri = URI.parse(url)
 http = Net::HTTP.new(uri.host, uri.port)
 http.use_ssl = true
 #more than 10 seconds this is too slow
 http.open_timeout = 10
 http.read_timeout = 10
 request = Net::HTTP::Get.new(uri.request_uri)
 response = http.request(request)

 if response.code.to_i == 200
   return true
 else
   puts "Failed to GET #{url}: #{response.code.to_i}"
   return false
 end
end

 
The error message states:
SSL_connect returned=1 errno=0 state=error: certificate verify failed (certificate has expired)

Despite the certificate being valid and automatically renewing via Let’s Encrypt, this issue arises suddenly without any recent code changes. Your Rails application throws an error related to SSL verification.

Solution 1:

After thorough investigation and community discussions on Let’s Encrypt, you identify the root cause of the problem: the expiration of the Let’s Encrypt DST Root CA X3 certificate. To resolve this SSL certificate error in your Ruby on Rails application, follow these steps:

1. Identify the Expired Certificate:
-> The Let’s Encrypt DST Root CA X3 certificate has expired, causing SSL verification failures in your Rails application.

2. Remove the Expired Certificate:
-> Execute the following command to remove the expired certificate:
sudo rm /usr/share/ca-certificates/mozilla/DST_Root_CA_X3.crt

3. Update CA Certificates:
-> Update the CA certificates to reflect the removal of the expired certificate:
sudo update-ca-certificates

4. Verify Resolution:
-> After removing and updating the CA certificates, verify that the SSL certificate error no longer occurs in your Ruby on Rails application.

By following these steps, you effectively resolve the SSL certificate error caused by the expiration of the Let’s Encrypt DST Root CA X3 certificate in your Ruby on Rails application.

Solution 2: Update SSL Certificates Bundle

Another approach to resolving SSL certificate errors in Ruby on Rails is to update the SSL certificates bundle used by your application. Sometimes, SSL verification failures occur due to outdated or incomplete SSL certificate bundles.

1. Download Updated Certificates Bundle:
-> Visit the official website of the certificate authority or a trusted source to download the latest SSL certificates bundle. Ensure that the bundle includes the necessary root and intermediate certificates.

2. Replace SSL Certificates Bundle:
-> Locate the SSL certificates bundle file used by your Ruby on Rails application. This file is typically named cacert.pem or similar.
-> Replace the existing SSL certificates bundle file with the downloaded and updated bundle.

3. Restart Application Server:
-> Restart your Ruby on Rails application server to apply the changes and ensure that the updated SSL certificates bundle is loaded.

4. Verify Resolution:
-> Test your application to verify that the SSL certificate error no longer occurs. Perform requests that previously triggered SSL verification failures to ensure that the issue has been resolved.

By updating the SSL certificates bundle used by your Ruby on Rails application, you provide it with the latest certificate authorities and ensure compatibility with recent changes in certificate issuance and validation. This approach can effectively resolve SSL certificate errors and enhance the security of your application’s communication over HTTPS.

Conclusion

SSL certificate errors can disrupt the functionality of your Ruby on Rails application, even when the certificates are valid. Understanding the underlying causes and promptly addressing issues such as expired certificates are crucial for maintaining the reliability and security of your application. Stay vigilant about certificate validity and keep abreast of updates and solutions provided by certificate authorities and the Ruby on Rails community to ensure seamless operation.