Cannot install any ruby gems on Mac OS - SSL_connect error
<p>My environment is Mac OS 10.10.5, ruby version 2.2.4 (or 2.2.2 or 2.2.0) gem (after upgrade) is 2.6.7, rvm version 1.27.0.</p>

<p>This has several duplicates even in the last few days but this is more information than I can put in a comment.</p>

<p>When installing any gems on any version of ruby I get the following:</p>

<pre><code>$ gem install bundler
ERROR:  Could not find a valid gem 'bundler' (&gt;= 0), here is why:
          Unable to download data from https://rubygems.org/ - SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed (https://api.rubygems.org/specs.4.8.gz)
</code></pre>

<p>There is a lot of information about this available, especially for problems on Windows. See <a href="http://guides.rubygems.org/ssl-certificate-update/" rel="nofollow">http://guides.rubygems.org/ssl-certificate-update/</a> for the proposed solution. I follow this but I continue to get the same error. </p>

<p>The problem seems to be in getting the file GlobalSignRootCA.pem in the appropriate place which is not entirely clear. The above link explains how to find the appropriate ssl_certs directory, of which there are 2 in my system, but neither work. </p>

<p>I forget where I learned the following:</p>

<pre><code>$ ruby -ropenssl -e 'puts OpenSSL::X509::DEFAULT_CERT_DIR'
/etc/openssl/certs
$ ruby -ropenssl -e 'puts OpenSSL::X509::DEFAULT_CERT_FILE'
/etc/openssl/cert.pem
</code></pre>

<p>which might have given a hint but appending the .pem file to the latter or copying to the former have no effect.</p>

<p>When I re-install openssl (homebrew), it helpfully tells me:</p>

<pre><code>A CA file has been bootstrapped using certificates from the system
keychain. To add additional certificates, place .pem files in
  /usr/local/etc/openssl/certs

and run
  /usr/local/opt/openssl/bin/c_rehash
</code></pre>

<p>but this also does not solve the problem.</p>

<p>From another SO question:</p>

<pre><code>rvm osx-ssl-certs update all
</code></pre>

<p>doesn't work. Nor does:</p>

<pre><code>security find-certificate -a -p /Library/Keychains/System.keychain &gt; "$cert_file"
security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain &gt;&gt; "$cert_file"
</code></pre>

<p>Does anyone know how to get a sense of what rubygems expects here? Where does it want this file or is this even the file it wants? Should I import the .pem file into the OSX keychain? How does one do that?</p>

<p>Or is there a way to get the gem file and install it locally? rubygems does this helpfully for rubygems itself but not for the individual gems from what I can tell.</p>

<p>-- workaround</p>

<p>Okay - the answer to the question of where to get the gem: go to <code>https://rubygems.org/gems/[package name]</code> and select a version and go to download - currently under links on the right hand side. Download the file and <code>gem install --local [downloaded gem file]</code>. Plus all the dependencies.</p>

<p>To automate:</p>

<pre><code># start by adding insecure source for --explain - thanks to @tnum
gem source -a http://rubygems.org/
while read x 
do
wget https://rubygems.org/downloads/$x.gem
gem install --local $x.gem 
rm $x.gem
done &lt; &lt;(gem install --explain [package name] | grep "^  ")
# remove insecure source
gem source -r http://rubygems.org/
</code></pre>

<p>Some of the lack of security could be mitigated by a better grep regex but it is still insecure. Note that <code>wget https://</code> works so the ssl problem is definitely with rubygems. </p>