title: Retrieve PEM cert: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed
body: <p>As many others I've got the error with Ruby: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed.</p>
  
  <p>I downloaded a cacert.pem and tried to add it like this:</p>
  
  <pre><code>require 'net/http'
  
  # create a path to the file "C:\RailsInstaller\cacert.pem"
  cacert_file = File.join(%w{c: RailsInstaller cacert.pem})
  
  Net::HTTP.start("curl.haxx.se") do |http|
    resp = http.get("/ca/cacert.pem")
    if resp.code == "200"
      open(cacert_file, "wb") { |file| file.write(resp.body) }
      puts "\n\nA bundle of certificate authorities has been installed to"
      puts "C:\\RailsInstaller\\cacert.pem\n"
      puts "* Please set SSL_CERT_FILE in your current command prompt session with:"
      puts "     set SSL_CERT_FILE=C:\\RailsInstaller\\cacert.pem"
      puts "* To make this a permanent setting, add it to Environment Variables"
      puts "  under Control Panel -&gt; Advanced -&gt; Environment Variables"
    else
      abort "\n\n&gt;&gt;&gt;&gt; A cacert.pem bundle could not be downloaded."
    end
  end
  </code></pre>
  
  <p>And like this:</p>
  
  <pre><code>require 'open-uri'
  require 'net/https'
  
  module Net
    class HTTP
      alias_method :original_use_ssl=, :use_ssl=
  
      def use_ssl=(flag)
        self.ca_file = Rails.root.join('lib/ca-bundle.crt')
        self.verify_mode = OpenSSL::SSL::VERIFY_PEER
        self.original_use_ssl = flag
      end
    end
  end
  </code></pre>
  
  <p>I even tried to cancel the check:</p>
  
  <pre><code>require 'faraday'
  module Faraday
  class Adapter
   class NetHttp &lt; Faraday::Adapter
    def call(env)
      super
  
      is_ssl = env[:url].scheme == 'https'
  
      http = net_http_class(env).new(env[:url].host, env[:url].port || (is_ssl ? 443 : 80))
      if http.use_ssl = is_ssl
        ssl = env[:ssl]
        if ssl[:verify] == false
          http.verify_mode = OpenSSL::SSL::VERIFY_NONE
        else
          http.verify_mode = OpenSSL::SSL::VERIFY_NONE # &lt;= PATCH or HACK ssl[:verify]
        end
        http.cert    = ssl[:client_cert] if ssl[:client_cert]
        http.key     = ssl[:client_key]  if ssl[:client_key]
        http.ca_file = ssl[:ca_file]     if ssl[:ca_file]
      end
      req = env[:request]
      http.read_timeout = net.open_timeout = req[:timeout] if req[:timeout]
      http.open_timeout = req[:open_timeout]               if req[:open_timeout]
  
      full_path = full_path_for(env[:url].path, env[:url].query, env[:url].fragment)
      http_req  = Net::HTTPGenericRequest.new(
        env[:method].to_s.upcase,    # request method
        (env[:body] ? true : false), # is there data
        true,                        # does net/http love you, true or false?
        full_path,                   # request uri path
      env[:request_headers])       # request headers
  
      if env[:body].respond_to?(:read)
        http_req.body_stream = env[:body]
        env[:body] = nil
      end
  
      http_resp = http.request http_req, env[:body]
  
      resp_headers = {}
      http_resp.each_header do |key, value|
        resp_headers[key] = value
      end
  
      env.update \
        :status           =&gt; http_resp.code.to_i,
        :response_headers =&gt; resp_headers,
        :body             =&gt; http_resp.body
  
      @app.call env
    rescue Errno::ECONNREFUSED
      raise Error::ConnectionFailed.new(Errno::ECONNREFUSED)
    end
  
    def net_http_class(env)
      if proxy = env[:request][:proxy]
        Net::HTTP::Proxy(proxy[:uri].host, proxy[:uri].port, proxy[:user], proxy[:password])
      else
        Net::HTTP
      end
    end
   end
  end
  end
  </code></pre>
  
  <p>But no luck (and not the way you want to fix this). Weird thing is that it works sometimes.</p>
  
  <p>Now I'm trying this, but have trouble finding the certificates:</p>
  
  <pre><code>require 'net/http'
  
  url = URI.parse('https://www.xpiron.com/schedule')
  req = Net::HTTP::Get.new(url.path)
  sock = Net::HTTP.new(url.host, 443)
  sock.use_ssl = true
  store = OpenSSL::X509::Store.new
  store.add_cert OpenSSL::X509::Certificate.new(File.new('addtrust_ca.pem'))
  store.add_cert OpenSSL::X509::Certificate.new(File.new('utn.pem'))
  store.add_cert OpenSSL::X509::Certificate.new(File.new('user_first_ca.pem'))
  store.add_cert OpenSSL::X509::Certificate.new(File.new('xpiron.pem'))
  sock.cert_store = store
  sock.start do |http|
    response = http.request(req)
  end
  </code></pre>
  
  <p>So I opened the <code>https://myserver.com/Request.ashx</code>request in chrome, clicked on the little lock-icon to get the certificate details. But I can't find any PEM files to export. I can see that it's a COMODO certificate. I don't own the server, so I got to find a solution for this on my side.</p>