ruby/ruby · error · Gem::CommandLineError

Passphrase and passphrase confirmation don't match

Error message

Passphrase and passphrase confirmation don't match

What it means

When `gem cert --build` must create a new key (no -K supplied), build_key prompts twice for a passphrase and requires the entries to match; differing entries raise Gem::CommandLineError 'Passphrase and passphrase confirmation don't match'. This is the standard confirm-the-secret pattern - nothing is generated before the check, so re-running is safe.

Source

Thrown at lib/rubygems/commands/cert_command.rb:174

    cert = Gem::Security.create_cert_email(
      email,
      key,
      Gem::Security::ONE_DAY * expiration_length_days
    )

    Gem::Security.write_certificate cert, "gem-public_cert.pem"
  end

  def build_key # :nodoc:
    return options[:key] if options[:key]

    passphrase = ask_for_password "Passphrase for your Private Key:"
    say "\n"

    passphrase_confirmation = ask_for_password "Please repeat the passphrase for your Private Key:"
    say "\n"

    raise Gem::CommandLineError,
          "Passphrase and passphrase confirmation don't match" unless passphrase == passphrase_confirmation

    algorithm = options[:key_algorithm] || Gem::Security::DEFAULT_KEY_ALGORITHM
    key = Gem::Security.create_key(algorithm)
    key_path = Gem::Security.write_private_key key, "gem-private_key.pem", 0o600, passphrase

    [key, key_path]
  end

  def certificates_matching(filter)
    return enum_for __method__, filter unless block_given?

    Gem::Security.trusted_certificates.select do |certificate, _|
      subject = certificate.subject.to_s
      subject.downcase.index filter
    end.sort_by do |certificate, _|
      certificate.subject.to_a.map {|name, data,| [name, data] }
    end.each do |certificate, path|

View on GitHub (pinned to 0e5b888e1c)

Solutions

1. Re-run the command and re-enter the passphrase carefully (no key was created)
2. Generate the key yourself and pass it with -K to avoid prompts entirely
3. Paste from a password manager for both prompts instead of typing long secrets

Example fix

# before (interactive typo)
$ gem cert --build dev@example.com
Passphrase for your Private Key: ********
Please repeat the passphrase for your Private Key: *********
# ERROR: Passphrase and passphrase confirmation don't match

# after (non-interactive: supply the key, skip the prompt)
openssl ecparam -genkey -name secp384r1 -out gem-private_key.pem
gem cert --build dev@example.com -K gem-private_key.pem

attempts = 0
begin
  ok = system('gem', 'cert', '--build', email)
  raise Gem::CommandLineError, 'gem cert --build failed' unless ok
rescue Gem::CommandLineError => e
  retry if e.message.include?("confirmation don't match") && (attempts += 1) < 3
  raise
end

When it happens

Trigger: A typo on the second prompt of `gem cert --build you@example.com`; pasting a long generated passphrase with an extra or missing character; terminal echo oddities when the prompt is driven through a wrapper.

Common situations: Interactive signing setup over SSH sessions; automation that tries to drive the two prompts non-interactively; password-manager paste timing issues.

Related errors

• #{cert_file}: does not exist
• #{certificate_file}: does not exist
• Invalid email address #{email}
• can't open %s. give up.\n
• RubyGems doesn't know about trust policy '#{trust_policy}'.

AI-assisted analysis of ruby/ruby@0e5b888e1c (2026-08-21). Data as JSON: /api/errors/5a6e3b52d5a88bd4. Report an issue: GitHub.