ruby/rubygems · error · Gem::Security::Exception

root cert #{root.subject} is not trusted

Error message

root cert #{root.subject} is not trusted

What it means

Error "root cert #{root.subject} is not trusted" thrown in ruby/rubygems.

Source

Thrown at lib/rubygems/security/policy.rb:164

  # Ensures the root of +chain+ has a trusted certificate in Gem::Security.trust_dir and
  # the digests of the two certificates match according to +digester+

  def check_trust(chain, digester, trust_dir)
    raise Gem::Security::Exception, "missing signing chain" unless chain

    root = chain.first

    raise Gem::Security::Exception, "missing root certificate" unless root

    path = Gem::Security.trust_dir.cert_path root

    unless File.exist? path
      message = "root cert #{root.subject} is not trusted".dup

      message << " (root of signing cert #{chain.last.subject})" if
        chain.length > 1

      raise Gem::Security::Exception, message
    end

    save_cert = OpenSSL::X509::Certificate.new File.read path
    save_dgst = digester.digest save_cert.public_key.public_to_pem

    pkey_str = root.public_key.public_to_pem
    cert_dgst = digester.digest pkey_str

    raise Gem::Security::Exception,
          "trusted root certificate #{root.subject} checksum " \
          "does not match signing root certificate checksum" unless
      save_dgst == cert_dgst

    true
  end

  ##
  # Extracts the email or subject from +certificate+

View on GitHub (pinned to 86cbb817a3)

Solutions

1. Trust the gem's root certificate: `gem cert --add <root-cert.pem>`
2. Or install with a lower security policy if you accept unsigned/untrusted gems

When it happens

Trigger: Thrown at lib/rubygems/security/policy.rb:164 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruby/rubygems@86cbb817a3 (2026-08-23). Data as JSON: /api/errors/397e27faedc7dc39. Report an issue: GitHub.