Linux: SSL/HTTPS Request Unable to Get Local Issuer Certificate #102300

New Issue

Anthony Russo · 2022-11-06T02:48:24+01:00

Anthony Russo commented

2022-11-06 02:48:24 +01:00

System Information
Operating system: Linux-5.15.0-52-generic-x86_64-with-glibc2.35 64 Bits (Ubuntu 22.04.1)
Graphics card: SVGA3D; build: RELEASE; LLVM; VMware, Inc. 4.1 (Core Profile) Mesa 22.0.5

Blender Version
Broken: version: 3.3.1, branch: master, commit date: 2022-10-04 18:35, hash: b292cfe5a9
Worked: version: 2.79b, date: 2018-03-22 14:10, hash: f4dc9f9d68b

Short description of error
HTTPS requests made via urllib always result in urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)>
Cert paths point to locations that do not exist on the machine and seem to be specific to the build environment: /home/sybren/buildbot-builder/linux_glibc217_x86_64_cmake/build_deps/deps/Release/ssl/certs
Whereas I'd expect it to be /usr/lib/ssl/certs which is the case in version 2.79b and in a separate python 3.10 interpreter.

Exact steps for others to reproduce the error
To view cert paths:

import ssl
ssl.get_default_verify_paths()

To make HTTPS request:

from urllib import request
request.urlopen('https://blender.org').status

**System Information** Operating system: Linux-5.15.0-52-generic-x86_64-with-glibc2.35 64 Bits (Ubuntu 22.04.1) Graphics card: SVGA3D; build: RELEASE; LLVM; VMware, Inc. 4.1 (Core Profile) Mesa 22.0.5 **Blender Version** Broken: version: 3.3.1, branch: master, commit date: 2022-10-04 18:35, hash: `b292cfe5a9` Worked: version: 2.79b, date: 2018-03-22 14:10, hash: `f4dc9f9d68b` **Short description of error** HTTPS requests made via urllib always result in `urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)>` Cert paths point to locations that do not exist on the machine and seem to be specific to the build environment: `/home/sybren/buildbot-builder/linux_glibc217_x86_64_cmake/build_deps/deps/Release/ssl/certs` Whereas I'd expect it to be `/usr/lib/ssl/certs` which is the case in version 2.79b and in a separate python 3.10 interpreter. **Exact steps for others to reproduce the error** To view cert paths: ``` import ssl ssl.get_default_verify_paths() ``` To make HTTPS request: ``` from urllib import request request.urlopen('https://blender.org').status ```

Anthony Russo commented

2022-11-06 02:48:24 +01:00

Added subscriber: @NullSenseStudio

Omar Emara commented

2022-11-08 12:12:42 +01:00

Changed status from 'Needs Triage' to: 'Confirmed'

Brecht Van Lommel commented

2022-11-16 16:21:24 +01:00

Added subscribers: @ideasman42, @brecht

Brecht Van Lommel commented

2022-11-16 16:21:24 +01:00

CC @campbellbarton.

Ray molenkamp commented

2022-11-16 17:11:21 +01:00

Added subscriber: @LazyDodo

Ray molenkamp commented

2022-11-16 17:11:21 +01:00

it seems to referencing a local path to the build VM, it works if i manually copy 3.4/python/lib/python3.10/site-packages/certifi/cacert.pem to /root/blender-git/build_linux/deps/Release/ssl/cert.pem

it seems to referencing a local path to the build VM, it works if i manually copy `3.4/python/lib/python3.10/site-packages/certifi/cacert.pem` to `/root/blender-git/build_linux/deps/Release/ssl/cert.pem`

Ray molenkamp commented

2022-11-16 17:34:55 +01:00

for 3.5 we do have a usercustomize.py I think if we set the env vars there to point to certifi's bundle (if the vars are not set to a valid file already) we'll be ok

for 3.5 we do have a `usercustomize.py` I think if we set the env vars there to point to certifi's bundle (if the vars are not set to a valid file already) we'll be ok

Brecht Van Lommel commented

2022-11-16 18:22:07 +01:00

We bundle the requests package, which I guess works and is what most Blender add-ons rely on. So the workaround would be using that instead of urllib.

@LazyDodo I wonder how it's handled on Windows and macOS. If they use system certificates in this case also, it may make sense to use /usr/lib/ssl/certs on Linux.

We bundle the `requests` package, which I guess works and is what most Blender add-ons rely on. So the workaround would be using that instead of `urllib`. @LazyDodo I wonder how it's handled on Windows and macOS. If they use system certificates in this case also, it may make sense to use `/usr/lib/ssl/certs` on Linux.

Ray molenkamp commented

2022-11-16 18:29:47 +01:00

windows: it tries to load C:\Program Files\Common Files\SSL\cert.pem which will in most cases fail, then falls back on the windows certificate store (for py 3.4+)
mac: no idea

windows: it tries to load `C:\Program Files\Common Files\SSL\cert.pem` which will in most cases fail, then falls back on the windows certificate store (for py 3.4+) mac: no idea

Brecht Van Lommel commented

2022-11-16 19:32:22 +01:00

Maybe pointing to /usr/lib/ssl/certs would be more consistent between platforms then, using system certs.

Maybe pointing to `/usr/lib/ssl/certs` would be more consistent between platforms then, using system certs.

Philipp Oeser removed the

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Linux: SSL/HTTPS Request Unable to Get Local Issuer Certificate #102300