Rails 6.1.4.1 : certificate verify failed (unable to get local issuer certificate) (OpenSSL::SSL::SSLError)

user_290580 0
Viewed 1289

Rails/Ruby/OpenSSL will not let me send out emails, why?

Test in the console:

irb(main):001:0> @webmessage = Webmessage.new(subject: "Hi there", body: "Bye now.", email: "me@me.com", firstname: "Me")
=> #<Webmessage:0x000055bee43fa1d0 id: nil, subject: "Hi there", body: "Bye now.", email: "me@me.com", firstname: "Me">

irb(main):002:0> ApplicationMailer.with(webmessage: @webmessage).email_webmessage.deliver_now
  Rendered application_mailer/email_webmessage.html.erb within layouts/mailer (Duration: 3.2ms | Allocations: 810)
  Rendered layout layouts/mailer.html.erb (Duration: 4.3ms | Allocations: 1044)
Delivered mail 614243a5a9582_9b0ab4874e5@host.mail (52.1ms)
/home/user/.rbenv/versions/3.0.1/lib/ruby/3.0.0/net/protocol.rb:46:in `connect_nonblock': SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate) (OpenSSL::SSL::SSLError)

Resulting error:

"SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate) (OpenSSL::SSL::SSLError)"

My cert paths:

$ echo $SSL_CERT_DIR
/etc/ssl/certs

$ echo $SSL_CERT_FILE
/etc/ssl/certs/ca-certificates.crt

My environment:

  • Rails 6.1.4.1
  • Ruby 3.0.1p64
  • OpenSSL 1.1.1f

EDIT: This establishes a working connection:

$ openssl s_client -connect example.com:443 -CAfile /etc/ssl/certs/ca-certificates.crt


irb(main):001:0> require 'open-uri'
=> true

irb(main):002:0> p open(URI.open('https://google.com'))
#<File:/tmp/open-uri20210915-4444-phdsb>
=> #<File:/tmp/open-uri20210915-4444-phdsb>
openssl ruby-on-rails ruby
1 Answers

Here's the solution, for posterity:

It turns out that Rails needed one of the following entries in config/environments/production.rb for the above mentioned error to disappear:

config.force_ssl = true

config.action_mailer.default_url_options = {
    protocol: 'https',
    host: "www.mydomain.com"
}

config.action_mailer.delivery_method = :sendmail
config.action_mailer.sendmail_settings = {
    location: '/usr/sbin/sendmail',
    arguments: '-i -t'
}
user_2905800
Related