ruby/rubygems · error · Gem::Security::Exception

trusted root certificate #{root.subject} checksum does not m

Error message

trusted root certificate #{root.subject} checksum does not match signing root certificate checksum

What it means

Error "trusted root certificate #{root.subject} checksum does not match signing root certificate checksum" thrown in ruby/rubygems.

Source

Thrown at lib/rubygems/security/policy.rb:173

    path = Gem::Security.trust_dir.cert_path root

    unless File.exist? path
      message = "root cert #{root.subject} is not trusted".dup

      message << " (root of signing cert #{chain.last.subject})" if
        chain.length > 1

      raise Gem::Security::Exception, message
    end

    save_cert = OpenSSL::X509::Certificate.new File.read path
    save_dgst = digester.digest save_cert.public_key.public_to_pem

    pkey_str = root.public_key.public_to_pem
    cert_dgst = digester.digest pkey_str

    raise Gem::Security::Exception,
          "trusted root certificate #{root.subject} checksum " \
          "does not match signing root certificate checksum" unless
      save_dgst == cert_dgst

    true
  end

  ##
  # Extracts the email or subject from +certificate+

  def subject(certificate) # :nodoc:
    certificate.extensions.each do |extension|
      next unless extension.oid == "subjectAltName"

      return extension.value
    end

    certificate.subject.to_s

View on GitHub (pinned to 86cbb817a3)

Solutions

1. Remove the stale trusted certificate and re-add the correct one: `gem cert --remove` then `gem cert --add`

When it happens

Trigger: Thrown at lib/rubygems/security/policy.rb:173 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of ruby/rubygems@86cbb817a3 (2026-08-23). Data as JSON: /api/errors/1ced81992246fe7c. Report an issue: GitHub.