{"record":{"id":"bc86e17041d6bdcd","repo":"ruby/rubygems","slug":"incorrect-signing-key-for-re-signing-expired-cer","errorCode":null,"errorMessage":"incorrect signing key for re-signing #{expired_certificate.subject.to_s}","messagePattern":"incorrect signing key for re-signing #(.+?)","errorType":"exception","errorClass":"Gem::Security::Exception","httpStatus":null,"severity":"error","filePath":"lib/rubygems/security.rb","lineNumber":509,"sourceCode":"\n    cn, dcs = email_address.split \"@\"\n\n    dcs = dcs.split \".\"\n\n    OpenSSL::X509::Name.new([\n      [\"CN\", cn],\n      *dcs.map {|dc| [\"DC\", dc] },\n    ])\n  end\n\n  ##\n  # Signs +expired_certificate+ with +private_key+ if the keys match and the\n  # expired certificate was self-signed.\n  #--\n  # TODO increment serial\n\n  def self.re_sign(expired_certificate, private_key, age = ONE_YEAR, extensions = EXTENSIONS)\n    raise Gem::Security::Exception,\n          \"incorrect signing key for re-signing \" +\n          expired_certificate.subject.to_s unless\n      expired_certificate.check_private_key(private_key)\n\n    unless expired_certificate.subject.to_s ==\n           expired_certificate.issuer.to_s\n      subject = alt_name_or_x509_entry expired_certificate, :subject\n      issuer  = alt_name_or_x509_entry expired_certificate, :issuer\n\n      raise Gem::Security::Exception,\n            \"#{subject} is not self-signed, contact #{issuer} \" \\\n            \"to obtain a valid certificate\"\n    end\n\n    serial = expired_certificate.serial + 1\n\n    create_cert_self_signed(expired_certificate.subject, private_key, age,\n                            extensions, serial)","sourceCodeStart":491,"sourceCodeEnd":527,"githubUrl":"https://github.com/ruby/rubygems/blob/86cbb817a38ce8477b181c17467a703ded3f2be8/lib/rubygems/security.rb#L491-L527","documentation":"Error \"incorrect signing key for re-signing #{expired_certificate.subject.to_s}\" thrown in ruby/rubygems.","triggerScenarios":"Thrown at lib/rubygems/security.rb:509 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-sign with the private key matching the expired certificate's original signing key"],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"86cbb817a38ce8477b181c17467a703ded3f2be8","analyzedAt":"2026-08-23T06:27:48.159Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}