Fixing RubyGems SSL Certificate Errors on Windows

If gem install jekyll fails on Windows with SSL_connect or certificate verify failed, Ruby cannot validate the certificate presented by RubyGems.org. The cause is usually an outdated or missing certificate authority (CA) list, an incorrect system clock, or a network proxy that intercepts TLS. It is not a reason to turn off certificate verification or download a certificate bundle from an arbitrary source.

Check the error and your Ruby installation

Start with the exact error. A certificate-verification failure is different from a timeout, a DNS problem, or a TLS protocol error; those need different fixes. In PowerShell, check which Ruby executable is being used and which versions are installed:

where.exe ruby
ruby -v
gem --version
bundle --version

If where.exe ruby lists more than one location, make sure the first one is the installation you intend to use. An old Ruby earlier in PATH can keep using an outdated OpenSSL setup even after you install a newer version.

With a recent Bundler, run its SSL diagnostic:

bundle doctor ssl

It checks the Ruby OpenSSL setup, certificate configuration, and a test connection to RubyGems.org. You can also capture gem env when investigating a failure. Redact usernames, private paths, proxy credentials, and other sensitive values before sharing diagnostic output.

Fix common certificate failures

1. Check Windows date and time. Certificates are valid only during a defined time window. Correct the clock and enable automatic time synchronization if it is wrong.

2. Update an old Ruby installation. Use a supported Ruby+Devkit release from the RubyInstaller downloads page that meets your project's Ruby requirements, then open a new terminal and confirm where.exe ruby points to it. RubyInstaller releases include a Mozilla CA list; newer releases refresh that list. See the RubyInstaller FAQ and its SSL certificate notes.

3. Update RubyGems when a secure connection is available. Run gem update --system to update RubyGems. For an existing Bundler project, update Bundler only when appropriate for that project (bundle update --bundler can change Gemfile.lock). If the certificate error prevents these commands from connecting, updating Ruby through RubyInstaller is the safer first step; do not bypass TLS to force the update.

4. Check for a custom certificate override. Ruby's OpenSSL may use SSL_CERT_FILE or SSL_CERT_DIR. In PowerShell, inspect whether either variable is set:

   Get-ChildItem Env:SSL_CERT_FILE, Env:SSL_CERT_DIR -ErrorAction SilentlyContinue
   

   A stale path or incomplete CA file can replace or disrupt the certificates Ruby would otherwise use. OpenSSL documents these variables in its environment-variable reference.

5. Ask about TLS inspection on managed networks. If gem installs fail only on a work or school network, a proxy may be presenting certificates signed by an organization-specific CA. Ask the administrator for the approved CA certificate and Ruby configuration. RubyInstaller documents adding an approved PEM certificate under <Ruby install>\ssl\certs\; do not overwrite its bundled cert.pem. SSL_CERT_FILE replaces RubyInstaller's bundled CA list, so an override must contain every CA the connection needs, not just the organization's certificate.

If your network requires an HTTP proxy, use the address supplied by its administrator with RubyGems' --http-proxy option. Replace the sample address below with your approved proxy:

gem install jekyll --http-proxy http://proxy.company.test:8080

Retry the gem install

After correcting the clock, Ruby installation, or approved proxy/CA configuration, open a new PowerShell window and retry:

gem install jekyll

If the error persists, use the RubyGems TLS troubleshooting guide and include the sanitized output of bundle doctor ssl, gem env, and bundle env when asking for help. For a Jekyll installation overview, see the official Jekyll site and Ruby's installation documentation.

Do not disable certificate verification, switch RubyGems.org to HTTP, or install a CA file from an untrusted download. Those changes can expose gem downloads to interception.

Historical note: The screenshot below shows the system-wide SSL_CERT_FILE workaround from the original 2014 article. It is not the recommended fix for current RubyInstaller releases.

The original screenshot shows a system-wide certificate-file workaround; use the current steps above instead.