handle more cert validation failures

fixes #2344

2 files changed, 14 insertions, 4 deletions

diff --git a/lib/bundler/fetcher.rb b/lib/bundler/fetcher.rb
index 849d154466..a3473b3ef5 100644
--- a/lib/bundler/fetcher.rb
+++ b/lib/bundler/fetcher.rb
@@ -123,9 +123,9 @@ module Bundler
       end
 
       index
-    rescue OpenSSL::SSL::SSLError
+    rescue CertificateFailureError => e
       Bundler.ui.info "" if gem_names && use_api # newline after dots
-      raise CertificateFailureError.new(@public_uri)
+      raise e
     end
 
     # fetch index
@@ -197,6 +197,8 @@ module Bundler
           req = Net::HTTP::Get.new uri.request_uri
           response = @connection.request(req)
         end
+      rescue OpenSSL::SSL::SSLError
+        raise CertificateFailureError.new(@public_uri)
       rescue *HTTP_ERRORS
         raise HTTPError, "Network error while fetching #{uri}"
       end
@@ -256,6 +258,8 @@ module Bundler
       else
         raise HTTPError, "Could not fetch specs from #{@public_uri}"
       end
+    rescue OpenSSL::SSL::SSLError
+      raise CertificateFailureError.new(@public_uri)
     end
 
     def well_formed_dependency(name, *requirements)
diff --git a/spec/install/gems/dependency_api_spec.rb b/spec/install/gems/dependency_api_spec.rb
index 5d3cc8b1af..bfc02e7d4d 100644
--- a/spec/install/gems/dependency_api_spec.rb
+++ b/spec/install/gems/dependency_api_spec.rb
@@ -433,11 +433,17 @@ describe "gemcutter's dependency API" do
   end
 
   context "when SSL certificate verification fails" do
-    it "explains what is going on" do
+    it "explains what happened" do
       # Install a monkeypatch that reproduces the effects of openssl raising
       # a certificate validation error at the appropriate moment.
       gemfile <<-G
-        class Bundler::Fetcher
+        class Net::HTTP::Persistent
+          def request(uri, req = nil)
+            raise OpenSSL::SSL::SSLError, "Certificate invalid"
+          end
+        end
+
+        class Bundler::RubygemsIntegration
           def fetch_all_remote_specs
             raise OpenSSL::SSL::SSLError, "Certificate invalid"
           end