ruby/rubygems · error · Gem::Security::Exception

#{subject} is not self-signed, contact #{issuer} to obtain a

Error message

#{subject} is not self-signed, contact #{issuer} to obtain a valid certificate

What it means

Error "#{subject} is not self-signed, contact #{issuer} to obtain a valid certificate" thrown in ruby/rubygems.

Source

Thrown at lib/rubygems/security.rb:519

  ##
  # Signs +expired_certificate+ with +private_key+ if the keys match and the
  # expired certificate was self-signed.
  #--
  # TODO increment serial

  def self.re_sign(expired_certificate, private_key, age = ONE_YEAR, extensions = EXTENSIONS)
    raise Gem::Security::Exception,
          "incorrect signing key for re-signing " +
          expired_certificate.subject.to_s unless
      expired_certificate.check_private_key(private_key)

    unless expired_certificate.subject.to_s ==
           expired_certificate.issuer.to_s
      subject = alt_name_or_x509_entry expired_certificate, :subject
      issuer  = alt_name_or_x509_entry expired_certificate, :issuer

      raise Gem::Security::Exception,
            "#{subject} is not self-signed, contact #{issuer} " \
            "to obtain a valid certificate"
    end

    serial = expired_certificate.serial + 1

    create_cert_self_signed(expired_certificate.subject, private_key, age,
                            extensions, serial)
  end

  ##
  # Resets the trust directory for verifying gems.

  def self.reset
    @trust_dir = nil
  end

  ##

View on GitHub (pinned to 86cbb817a3)

Solutions

  1. Obtain a valid certificate from the reported issuer, or use a self-signed certificate for your own gems

When it happens

Trigger: Thrown at lib/rubygems/security.rb:519 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

AI-assisted analysis of ruby/rubygems@86cbb817a3 (2026-08-23). Data as JSON: /api/errors/b13f29c090989795. Report an issue: GitHub.