ruby/rubygems · error · Gem::Security::Exception

root certificate #{root.subject} is not self-signed (issuer

Error message

root certificate #{root.subject} is not self-signed (issuer #{root.issuer})

What it means

Error "root certificate #{root.subject} is not self-signed (issuer #{root.issuer})" thrown in ruby/rubygems.

Source

Thrown at lib/rubygems/security/policy.rb:137

    raise Gem::Security::Exception,
      "certificate #{signer.subject} does not match the signing key" unless
        signer.check_private_key(key)

    true
  end

  ##
  # Ensures the root certificate in +chain+ is self-signed and valid for
  # +time+.

  def check_root(chain, time)
    raise Gem::Security::Exception, "missing signing chain" unless chain

    root = chain.first

    raise Gem::Security::Exception, "missing root certificate" unless root

    raise Gem::Security::Exception,
          "root certificate #{root.subject} is not self-signed " \
          "(issuer #{root.issuer})" if
      root.issuer != root.subject

    check_cert root, root, time
  end

  ##
  # Ensures the root of +chain+ has a trusted certificate in Gem::Security.trust_dir and
  # the digests of the two certificates match according to +digester+

  def check_trust(chain, digester, trust_dir)
    raise Gem::Security::Exception, "missing signing chain" unless chain

    root = chain.first

    raise Gem::Security::Exception, "missing root certificate" unless root

View on GitHub (pinned to 86cbb817a3)

Solutions

1. The chain's root must be self-signed; rebuild the chain with the correct root certificate

When it happens

Trigger: Thrown at lib/rubygems/security/policy.rb:137 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of ruby/rubygems@86cbb817a3 (2026-08-23). Data as JSON: /api/errors/cb6255213785779e. Report an issue: GitHub.