SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed

[insub]

RUBY: 2.1.5
Rails: 4.2.4
pingpp gem: 2.1.0

然后我在rails控制器里面open("xxx")测了一下，https://github.com ok. https://aliyun.com ok.
https://pingxx.com 报SSL错误

如何解决？现在网站整个支付都不可用了。

[menghuanwd]

你还是用回2.0.15吧，他们新的gem有点问题。

[samurai00]

如果不用 rails 的话，会报错吗？，我们这边使用 ruby 2.1.5 + pingpp 2.1.0 没有这样的 ssl 报错。
你这边可以看一下 openssl 的版本号吗？

[insub]

服务器上Openssl的版本号是：OpenSSL 1.0.1 14 Mar 2012

[insub]

gem降级到2.0.15也不行....
@menghuanwd @samurai00 是否降级到别的版本能有效？

[insub]

现在看的话，跟GEM包也没有关系，curl http://www.aliyun.com 没有问题，curl http://www.pingxx.com 就已经不行了，浏览器访问没问题

[insub]

D:\Sites>curl https://api.pingxx.com
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.

[insub]

curl --version
curl 7.30.0 (i386-pc-win32) libcurl/7.30.0 OpenSSL/0.9.8{ zlib/1.2.7
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp smtp smtps telnet tftp
Features: AsynchDNS GSS-Negotiate IPv6 Largefile NTLM SPNEGO SSL SSPI libz

[samurai00]

你试试把 https://curl.haxx.se/ca/cacert.pem 下载下来，curl 加上 --cacert 参数，看看还报不报错

[samurai00]

@insub 你试了吗？现在什么情况了？

[insub]

@samurai00 hi，之前已经试过了，刚才又再试了一下，一样的结果，aliyun.com可以，pingxx.com或者api.pingxx.com都不行

[insub]

@samurai00 ubuntu上已经可以了，没有做什么调整...突然就又可以了

[samurai00]

会不会是 dns 解析之类的问题？

[GiaoGiaoCat]

Ruby: 2.3.0
Rails: 5.0.1.rc2
pingpp gem: 2.1.0
openssl version: OpenSSL 1.0.1e-fips 11 Feb 2013

请求 API 出现错误

Pingpp::APIConnectionError: Could not verify Pingpp's SSL certificate. Please make sure that your network is not intercepting certificates. (Try going to (https://api.pingxx.com) in your browser.)

(Network error: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed)

执行 curl 'https://api.pingxx.com'

{
    "error": {
        "type": "invalid_request_error",
        "message": "没有提供合适的 API KEY。需要在 header 中加入已授权的 API KEY 的声明 (如：'Authorization: Bearer YOUR_SECRET_KEY')。"
    }
}

除了更新 gem 之外没有做其它操作，一直好使，更新了 gem 就炸了。

gem 从 2.0.15 升级上来的。

[GiaoGiaoCat]

降级到 2.0.15 之后，重启 Rails 服务就好使了。

[GiaoGiaoCat]

我看你的更新日志，2.1.0 更新了证书，原因是？