ruby/rubygems · error · Gem::Security::Exception

incorrect signing key for re-signing #{expired_certificate.s

Error message

incorrect signing key for re-signing #{expired_certificate.subject.to_s}

What it means

Error "incorrect signing key for re-signing #{expired_certificate.subject.to_s}" thrown in ruby/rubygems.

Source

Thrown at lib/rubygems/security.rb:509

    cn, dcs = email_address.split "@"

    dcs = dcs.split "."

    OpenSSL::X509::Name.new([
      ["CN", cn],
      *dcs.map {|dc| ["DC", dc] },
    ])
  end

  ##
  # Signs +expired_certificate+ with +private_key+ if the keys match and the
  # expired certificate was self-signed.
  #--
  # TODO increment serial

  def self.re_sign(expired_certificate, private_key, age = ONE_YEAR, extensions = EXTENSIONS)
    raise Gem::Security::Exception,
          "incorrect signing key for re-signing " +
          expired_certificate.subject.to_s unless
      expired_certificate.check_private_key(private_key)

    unless expired_certificate.subject.to_s ==
           expired_certificate.issuer.to_s
      subject = alt_name_or_x509_entry expired_certificate, :subject
      issuer  = alt_name_or_x509_entry expired_certificate, :issuer

      raise Gem::Security::Exception,
            "#{subject} is not self-signed, contact #{issuer} " \
            "to obtain a valid certificate"
    end

    serial = expired_certificate.serial + 1

    create_cert_self_signed(expired_certificate.subject, private_key, age,
                            extensions, serial)

View on GitHub (pinned to 86cbb817a3)

Solutions

  1. Re-sign with the private key matching the expired certificate's original signing key

When it happens

Trigger: Thrown at lib/rubygems/security.rb:509 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

AI-assisted analysis of ruby/rubygems@86cbb817a3 (2026-08-23). Data as JSON: /api/errors/bc86e17041d6bdcd. Report an issue: GitHub.