title: OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate)
body: <p>There are a ton of posts about this. I have looked at so many of them. Zero of the fixes seem to work.</p>
  <pre class="lang-ruby prettyprint-override"><code>(main)&gt; PayPal::SDK::Subscriptions::Plan.all
  Request[post]: https://api.sandbox.paypal.com/v1/oauth2/token
  Request.body=grant_type=client_credentials  request.header={&quot;User-Agent&quot;=&gt;&quot;PayPalSDK/PayPal-Subscriptions-Ruby-SDK 0.3.1 (paypal-sdk-core 1.7.4; ruby 2.6.6p146-x86_64-linux;OpenSSL 1.1.1d  10 Sep 2019)&quot;, &quot;Content-Type&quot;=&gt;&quot;application/x-www-form-urlencoded&quot;, &quot;Authorization&quot;=&gt;&quot;Basic xxx&quot;}
  OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate)
  from /usr/local/lib/ruby/2.6.0/net/protocol.rb:44:in `connect_nonblock'
  </code></pre>
  <p>I have tried rvm 2.6.6, 2.7.0, and Debian Buster system ruby.</p>
  <p>I followed all of these:
  <a href="https://bundler.io/v2.0/guides/rubygems_tls_ssl_troubleshooting_guide.html#troubleshooting-certificate-errors" rel="noreferrer">https://bundler.io/v2.0/guides/rubygems_tls_ssl_troubleshooting_guide.html#troubleshooting-certificate-errors</a></p>
  <p>I ran the automated SSL check and everything is roses:
  <a href="https://bundler.io/v2.0/guides/rubygems_tls_ssl_troubleshooting_guide.html#automated-ssl-check" rel="noreferrer">https://bundler.io/v2.0/guides/rubygems_tls_ssl_troubleshooting_guide.html#automated-ssl-check</a></p>
  <pre><code>root@19ab47f15632:/usr/src/app# curl -Lks 'https://git.io/rg-ssl' | ruby
  Here's your Ruby and OpenSSL environment:
  
  Ruby:           2.6.6p146 (2020-03-31 revision 67876) [x86_64-linux]
  RubyGems:       3.0.3
  Bundler:        2.1.2
  Compiled with:  OpenSSL 1.1.1d  10 Sep 2019
  Loaded version: OpenSSL 1.1.1d  10 Sep 2019
  SSL_CERT_FILE:  /usr/lib/ssl/cert.pem
  SSL_CERT_DIR:   /usr/lib/ssl/certs
  
  With that out of the way, let's see if you can connect to rubygems.org...
  
  Bundler connection to rubygems.org:       success ✅
  RubyGems connection to rubygems.org:      success ✅
  Ruby net/http connection to rubygems.org: success ✅
  
  Hooray! This Ruby can connect to rubygems.org. You are all set to use Bundler and RubyGems. 
  </code></pre>
  <p>I tried <code>gem update --system</code>, bundler is updated.</p>
  <p>I tried curling the new CA to the location of ruby's default SSL file:</p>
  <pre><code>curl -fsSL curl.haxx.se/ca/cacert.pem -o &quot;$(ruby -ropenssl -e 'puts OpenSSL::X509::DEFAULT_CERT_FILE')&quot;
  </code></pre>
  <p>I checked that my system's time was accurate (it's accurate to UTC).</p>
  <p>I have no earthly idea what to do from here. The PayPal SDK subscription gem is using net/http under the covers because it relies on the core PayPal SDK gem. I tried increasing the loglevel to DEBUG but it prints out no additional details as it appears to fail in the same exact place, and I can't figure out where that failure actually is.</p>
  <p>I'm at a loss. Short of disabling SSL verification, I don't know what to do. Is there some way to get more traceback / more error here to troubleshoot further? Using net/http directly against the PayPal API works fine (no SSL error). So it's something that happens after the initial request</p>