{"record":{"id":"397e27faedc7dc39","repo":"ruby/rubygems","slug":"root-cert-root-subject-is-not-trusted","errorCode":null,"errorMessage":"root cert #{root.subject} is not trusted","messagePattern":"root cert #(.+?) is not trusted","errorType":"exception","errorClass":"Gem::Security::Exception","httpStatus":null,"severity":"error","filePath":"lib/rubygems/security/policy.rb","lineNumber":164,"sourceCode":"  # Ensures the root of +chain+ has a trusted certificate in Gem::Security.trust_dir and\n  # the digests of the two certificates match according to +digester+\n\n  def check_trust(chain, digester, trust_dir)\n    raise Gem::Security::Exception, \"missing signing chain\" unless chain\n\n    root = chain.first\n\n    raise Gem::Security::Exception, \"missing root certificate\" unless root\n\n    path = Gem::Security.trust_dir.cert_path root\n\n    unless File.exist? path\n      message = \"root cert #{root.subject} is not trusted\".dup\n\n      message << \" (root of signing cert #{chain.last.subject})\" if\n        chain.length > 1\n\n      raise Gem::Security::Exception, message\n    end\n\n    save_cert = OpenSSL::X509::Certificate.new File.read path\n    save_dgst = digester.digest save_cert.public_key.public_to_pem\n\n    pkey_str = root.public_key.public_to_pem\n    cert_dgst = digester.digest pkey_str\n\n    raise Gem::Security::Exception,\n          \"trusted root certificate #{root.subject} checksum \" \\\n          \"does not match signing root certificate checksum\" unless\n      save_dgst == cert_dgst\n\n    true\n  end\n\n  ##\n  # Extracts the email or subject from +certificate+","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/ruby/rubygems/blob/86cbb817a38ce8477b181c17467a703ded3f2be8/lib/rubygems/security/policy.rb#L146-L182","documentation":"Error \"root cert #{root.subject} is not trusted\" thrown in ruby/rubygems.","triggerScenarios":"Thrown at lib/rubygems/security/policy.rb:164 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Trust the gem's root certificate: `gem cert --add <root-cert.pem>`","Or install with a lower security policy if you accept unsigned/untrusted gems"],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"86cbb817a38ce8477b181c17467a703ded3f2be8","analyzedAt":"2026-08-23T06:27:48.159Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}