title: Ruby Net::HTTP responds with OpenSSL::SSL::SSLError "certificate verify failed" after certificate renewal
body: <p>We recently renewed the SSL certificate of our site, and the following occurs on Mac OS El Capitan 10.11.3:</p>
  
  <pre><code>require 'net/http'
  
  Net::HTTP.get URI('https://www.google.com')
  # =&gt; "&lt;HTML&gt;...&lt;/HTML&gt;"
  
  # The site whose certificate got renewed
  Net::HTTP.get URI('https://www.example.com')
  # =&gt; OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=error: certificate verify failed
  </code></pre>
  
  <p>All my searches on Google and StackOverflow come up with answers suggesting a problem with the Ruby installation, but they seem to be related to older Ruby versions and I don't think this is the case here. Here is what I've tried:</p>
  
  <ul>
  <li><code>brew update</code></li>
  <li><code>brew upgrade openssl</code></li>
  <li><code>rvm osx-ssl-certs update all</code></li>
  <li><code>rvm install ruby-2.3.1 --disable-binary --with-openssl-dir="$(brew --prefix openssl)"</code> (I did not have this version before)</li>
  <li><code>rvm requirements</code></li>
  <li><code>crlrefresh rpv</code> to purge the OSX system wide CRL cache, per Uzbekjon's suggestion.</li>
  </ul>
  
  <p>How can I resolve this?</p>
  
  <p>Notes:</p>
  
  <ul>
  <li>The problem does not occur on a freshly installed linux Docker container that has bare Ruby 2.2.3. So maybe it's something to do with Mac OS, or SSL local caching.</li>
  <li>This issue might have existed before the certificate renewal. I cannot know for sure. However, the renewal did cause a similar problem with a 3rd party we're using as I discuss in <a href="https://stackoverflow.com/questions/36965535/mailgun-webhooks-https-certificate-validation-failure-after-renewing-ssl-cert">this question</a>.</li>
  <li>The certificate installation was verified by Namecheap to be correct, online checkers show everything works, and all major browsers show the certificate as valid.</li>
  </ul>
  
  <hr>
  
  <h2>Solution</h2>
  
  <p>With much help from BoraMa, it is now clear what was happening. COMODO added a new root called <code>COMODO RSA Certification Authority</code> instead of the previous <code>COMODO Certification Authority</code>. The new root was not registered within Mac's keychain, causing this issue. </p>
  
  <p>One way we attempted to debug this was by running:</p>
  
  <pre><code>openssl s_client -connect www.mysite.com:443
  </code></pre>
  
  <p>Which showed a warning <code>verify error:num=20:unable to get local issuer certificate</code>. This warning is not an issue, as <code>openssl s_client</code> does not use any certificates by default. Running the following was able to prevent the warning after downloading the certificate <a href="https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/969/108/root-comodo-rsa-certification-authority-sha-2" rel="nofollow noreferrer">from COMODO</a> into <code>comodo.pem</code> (index <a href="https://support.comodo.com/index.php?/Default/Knowledgebase/List/Index/71" rel="nofollow noreferrer">here</a>):</p>
  
  <pre><code>openssl s_client -connect www.mysite.com:443 -CAfile comodo.pem
  </code></pre>
  
  <p>However, this could not and did not affect Ruby OpenSSL interface. <a href="http://mislav.net/2013/07/ruby-openssl/" rel="nofollow noreferrer">This article</a> made things much clearer for me, and the <a href="https://github.com/mislav/ssl-tools/blob/8b3dec4/doctor.rb" rel="nofollow noreferrer">SSL doctor script</a> created by its author was also helpful, as it confirmed the hypothesis. The article suggested to look at <code>OpenSSL::X509::DEFAULT_CERT_FILE</code>, which for me was <code>/usr/local/etc/openssl/cert.pem</code>. That file did not exist on my machine, which meant Apple's patch for OpendSSL was using the Keychain App. For whatever reason, importing <code>comodo.pem</code> into my keychain and marking it as trusted based on <a href="https://discussions.apple.com/message/28381202#28381202" rel="nofollow noreferrer">this post</a> did not work.</p>
  
  <p>So, the solution was to create the <code>cert.pem</code> file manually. I went to the keychain app, and exported all System Root certificates to <code>system_root.pem</code>. Then: <code>cat system_root.pem comodo.pem &gt; cert.pem</code> and moving that file to <code>/usr/local/etc/openssl/</code> did the trick. Running <code>Net::HTTP.get</code> in Ruby no longer failed. </p>