# SSL problem with embedded ruby on Windows?

**URL:** <https://discourse.chef.io/t/ssl-problem-with-embedded-ruby-on-windows/4091>\
**Category:** Chef Infra (archive)\
**Created:** [June 14, 2013, 7:44am UTC](https://discourse.chef.io/t/ssl-problem-with-embedded-ruby-on-windows/4091 "2013-06-14T07:44:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jeppe\_Nejsum\_Madsen](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/jeppe_nejsum_madsen/32/258_2.png) [@Jeppe\_Nejsum\_Madsen](https://discourse.chef.io/u/Jeppe_Nejsum_Madsen)\
**Post date:** [June 14, 2013, 7:44am UTC](https://discourse.chef.io/t/ssl-problem-with-embedded-ruby-on-windows/4091/1 "2013-06-14T07:44:34Z")

</div>

Hi,

I seem to have a problem with the embedded ruby when running on windows. It  
looks like the cacert.pem file is not located correctly:

C:\>irb  
irb(main):001:0\> require ‘open-uri’  
=\> true  
irb(main):002:0\> open "[https://google.com](https://google.com)"  
OpenSSL::SSL::SSLError: SSL\_connect returned=1 errno=0 state=SSLv3 read  
server certificate B: certificate verify failed  
from C:/opscode/chef/embedded/lib/ruby/1.9.1/net/http.rb:799:in  
`connect’

Not sure if this is expected or not. Setting SSL\_CERT\_FILE solves the  
issue.

There seems to be at least two ca-bundle.pem files in the embedded ruby,  
but not sure if they are supposed to be located automagically?

/Jeppe

---

<div class="post-metadata">

**Author:** ![Chirag\_Jog](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/chirag_jog/32/450_2.png) [@Chirag\_Jog](https://discourse.chef.io/u/Chirag_Jog)\
**Post date:** [June 14, 2013, 7:56am UTC](https://discourse.chef.io/t/ssl-problem-with-embedded-ruby-on-windows/4091/2 "2013-06-14T07:56:20Z")

</div>

Right. This is known issue for Windows. We have bug in JIRA to ship the  
certificate (self-signed) as part of Chef as we do in linux. Once that is  
fixed, SSL\_CERT\_FILE will not be required.

Regards\*,\*  
_Chirag Jog_  
Chief Technology Officer,  
_Clogeny Technologies_ | [http://clogeny.com](http://clogeny.com)  
(M) 0091-9766619440 | Skype: chirag.jog

On Fri, Jun 14, 2013 at 1:14 PM, Jeppe Nejsum Madsen [jeppe@ingolfs.dk](mailto:jeppe@ingolfs.dk)wrote:

> Hi,
> 
> I seem to have a problem with the embedded ruby when running on windows.  
> It looks like the cacert.pem file is not located correctly:
> 
> C:\>irb  
> irb(main):001:0\> require 'open-uri'  
> =\> true  
> irb(main):002:0\> open "[https://google.com](https://google.com)"  
> OpenSSL::SSL::SSLError: SSL\_connect returned=1 errno=0 state=SSLv3 read  
> server certificate B: certificate verify failed  
> from C:/opscode/chef/embedded/lib/ruby/1.9.1/net/http.rb:799:in  
> `connect'
> 
> Not sure if this is expected or not. Setting SSL\_CERT\_FILE solves the  
> issue.
> 
> There seems to be at least two ca-bundle.pem files in the embedded ruby,  
> but not sure if they are supposed to be located automagically?
> 
> /Jeppe

---

<div class="post-metadata">

**Author:** ![Jeppe\_Nejsum\_Madsen](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/jeppe_nejsum_madsen/32/258_2.png) [@Jeppe\_Nejsum\_Madsen](https://discourse.chef.io/u/Jeppe_Nejsum_Madsen)\
**Post date:** [June 14, 2013, 8:45am UTC](https://discourse.chef.io/t/ssl-problem-with-embedded-ruby-on-windows/4091/3 "2013-06-14T08:45:58Z")

</div>

Chirag Jog [chirag@clogeny.com](mailto:chirag@clogeny.com) writes:

> Right. This is known issue for Windows. We have bug in JIRA to ship the  
> certificate (self-signed) as part of Chef as we do in linux. Once that is  
> fixed, SSL\_CERT\_FILE will not be required.

Great, thanks for the heads up.

/Jeppe

---

<div class="post-metadata">

**Author:** ![Adam\_Edwards](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/adam_edwards/32/389_2.png) [@Adam\_Edwards](https://discourse.chef.io/u/Adam_Edwards)\
**Post date:** [June 14, 2013, 1:05pm UTC](https://discourse.chef.io/t/ssl-problem-with-embedded-ruby-on-windows/4091/4 "2013-06-14T13:05:23Z")

</div>

The readme on github talks about this, and the latest changes to knife-google on github include a better error message in this case. As Chirag says, including cacert.pem with omnibus Chef on Windows is the correct fix and is in progress at the moment.

The issue for this plug-in is tracked at [http://tickets.opscode.com/browse/KNIFE-279](http://tickets.opscode.com/browse/KNIFE-279).

Jeppe, great to see that you’re using this plug-in on Windows.

-Adam

From: Chirag Jog \<[chirag@clogeny.com](mailto:chirag@clogeny.com)[mailto:chirag@clogeny.com](mailto:chirag@clogeny.com)\>  
Date: Friday, June 14, 2013 12:56 AM  
To: "chef@lists.opscode.com[mailto:chef@lists.opscode.com](mailto:chef@lists.opscode.com)" \<[chef@lists.opscode.com](mailto:chef@lists.opscode.com)[mailto:chef@lists.opscode.com](mailto:chef@lists.opscode.com)\>, Adam Edwards \<[adamed@opscode.com](mailto:adamed@opscode.com)[mailto:adamed@opscode.com](mailto:adamed@opscode.com)\>  
Subject: Re: [chef] SSL problem with embedded ruby on Windows?

Right. This is known issue for Windows. We have bug in JIRA to ship the certificate (self-signed) as part of Chef as we do in linux. Once that is fixed, SSL\_CERT\_FILE will not be required.

Regards,  
Chirag Jog  
Chief Technology Officer,  
Clogeny Technologies | [http://clogeny.com](http://clogeny.com)[http://clogeny.com/](http://clogeny.com/)  
(M) 0091-9766619440 | Skype: chirag.jog

On Fri, Jun 14, 2013 at 1:14 PM, Jeppe Nejsum Madsen \<[jeppe@ingolfs.dk](mailto:jeppe@ingolfs.dk)[mailto:jeppe@ingolfs.dk](mailto:jeppe@ingolfs.dk)\> wrote:  
Hi,

I seem to have a problem with the embedded ruby when running on windows. It looks like the cacert.pem file is not located correctly:

C:\>irb  
irb(main):001:0\> require ‘open-uri’  
=\> true  
irb(main):002:0\> open "[https://google.com](https://google.com)"  
OpenSSL::SSL::SSLError: SSL\_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed  
from C:/opscode/chef/embedded/lib/ruby/1.9.1/net/http.rb:799:in `connect’

Not sure if this is expected or not. Setting SSL\_CERT\_FILE solves the issue.

There seems to be at least two ca-bundle.pem files in the embedded ruby, but not sure if they are supposed to be located automagically?

/Jeppe