diff --git a/install_nginx.sh b/install_nginx.sh
index ea31b04..70bbe75 100644
--- a/install_nginx.sh
+++ b/install_nginx.sh
@@ -90,6 +90,7 @@ if [ -z "$cpu_cores" ]; then
     cpu_cores="1";
 fi
 if [[ $(vercomp "$ubuntu_ver" "16") == "<" ]]; then #Need update ca-certificates manual
+    sudo apt-get install -y openssl libssl1.0 libssl-dev
     sudo apt-get install -y apt-transport-https ca-certificates
     sudo update-ca-certificates
     sudo bash -l -c "
@@ -99,7 +100,7 @@ if [[ $(vercomp "$ubuntu_ver" "16") == "<" ]]; then #Need update ca-certificates
         cd ca-certificates-20210119~20.04.1 &&
         make -j$cpu_cores && make install &&
         dpkg-reconfigure -fnoninteractive ca-certificates &&
-        if [ -e /etc/ca-certificates.conf ]; then sed -E 's/^!//g' -i /etc/ca-certificates.conf; fi &&
+        if [ -e /etc/ca-certificates.conf ]; then sed -E 's/^!//g' -i /etc/ca-certificates.conf; sed -i 's/mozilla\/DST_Root_CA_X3.crt/!mozilla\/DST_Root_CA_X3.crt/' /etc/ca-certificates.conf; fi &&
         dpkg-reconfigure -fnoninteractive ca-certificates &&
         update-ca-certificates --fresh --verbose &&
         /usr/bin/c_rehash /etc/ssl/certs"
diff --git a/install_orbit_environment.sh b/install_orbit_environment.sh
index c4558ba..501531c 100644
--- a/install_orbit_environment.sh
+++ b/install_orbit_environment.sh
@@ -268,7 +268,7 @@ need_export_apt_key="0"
 if [[ "$ubuntu_version" > '21' ]]; then # ruby must use openssl <= 1.1.1. Not support openssl 3.0 yet.
 	need_export_apt_key="1"
 	if [[ ! -d "/opt/openssl" ]]; then
-		target_openssl_ver="1.1.1q"
+		target_openssl_ver="1.1.1w"
 		sudo bash -l -c "
 			cd /root &&
 			wget https://www.openssl.org/source/openssl-$target_openssl_ver.tar.gz --no-check-certificate -O openssl-$target_openssl_ver.tar.gz &&
@@ -279,7 +279,7 @@ if [[ "$ubuntu_version" > '21' ]]; then # ruby must use openssl <= 1.1.1. Not su
 		openssl_ver="$target_openssl_ver"
 		cd "$org_pwd"
 	fi
-	openssl_dir="/opt/openssl/ssl/"
+	openssl_dir="/opt/openssl"
 	sudo rm -rf /opt/openssl/ssl/certs
 	sudo ln -s /etc/ssl/certs/ /opt/openssl/ssl/.
 	sudo mkdir -p /etc/apt/trusted.gpg.d/
@@ -358,7 +358,9 @@ source "/etc/profile.d/rvm.sh"
 if [[ -z "$openssl_dir" ]]; then
 	rvm install 2.7.6  --with-jemalloc
 else
-	rvm install 2.7.6 --with-openssl-dir="$openssl_dir"  --with-jemalloc
+	export CPPFLAGS="-I$openssl_dir/include"
+	export LDFLAGS="-L$openssl_dir/lib"
+	rvm install 2.7.6 -- --with-openssl-dir="$openssl_dir"  --with-jemalloc
 fi
 rvm --default use 2.7.6
 gem install bundler -v 2.1.4