SSL issue with MusicBrainz since a couple of days...

[JOJ0]

I'm getting this recently. SSL connectsions to metadata sources Spotify, Deezer, etc. work, only with MusicBrainz I get this SSL errror:

musicbrainzngs.musicbrainz.NetworkError: caused by: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1002)>

Error: MusicBrainz not reachable in get release by ID with query '561e9237-8063-4836-9485-f9c0f90a4233'
chroma: acoustid album candidates: 0
spotify: Searching Spotify for 'album:'
spotify: Found 20 result(s) from Spotify for 'album:'
Extracting album ID from '6JlCkqkqobGirPsaleJpFr'
Extracting album ID from '7aq7a226T631f2w1Vs1vXx'

I was supposing and also googling revealed, that this might be a problem on my end / my SSL CA certificate or something being outdated, but I'm not so sure anymore since SSL with Python basically seems to work fine with any other API's but MusicBrainz.

I'm on macO Catalina 10.15.7

Anyone else having trouble with musicbrainz lately or had this error in the past and can suggest help?

Thanks!

[JOJ0]

Most promising article around such errors with Python/SSL was that one: https://stackoverflow.com/questions/42098126/mac-osx-python-ssl-sslerror-ssl-certificate-verify-failed-certificate-verify/57614113#57614113

All I tried didn't help so far - especially "reinstalling with Install Certificates.command" doesn't help at all when you are in Python venv that is controlled by pyenv ;-) That file doesn't seem to be available anywhere

[arsaboo]

FWIW....MusicBrainz working fine here (I am not using venv). Must be something local. Can you try without venv or on another device?

[JOJ0]

Other device currently "difficult".....

Same device without venv (pyenv virutalenv actually!) "difficult" - don't want to mess up my system-python.....

but what I could test is a simple openssl s_client -connect.... to the musicbrainz api. Still I get this "unable to get local issuer...." error

No virtualenv/pyenv involved this time!!! I really don't get what this issue is about goddamnit :-/ .....

Server certificate
subject=CN = *.musicbrainz.org

issuer=C = FR, O = Gandi, CN = Gandi RSA Domain Validation Secure Server CA 3

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 3867 bytes and written 397 bytes
Verification error: unable to get local issuer certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 20 (unable to get local issuer certificate)Server certificate
subject=CN = *.musicbrainz.org

issuer=C = FR, O = Gandi, CN = Gandi RSA Domain Validation Secure Server CA 3

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 3867 bytes and written 397 bytes
Verification error: unable to get local issuer certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 20 (unable to get local issuer certificate)

[JOJ0]

Within my venv, I check the ca certificate that should be in use. It's absolutely fine - valid until: Jan 28 12:00:00 2028 GMT:

prod  beets310  ~/git/beets  ⇅ all_in  python
Python 3.10.5 (main, Jul 18 2022, 06:55:47) [Clang 12.0.0 (clang-1200.0.32.29)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import certifi
>>> certifi.where()
'/Users/jojo/.pyenv/versions/beets310/lib/python3.10/site-packages/certifi/cacert.pem'
>>>
 prod  beets310  ~/git/beets  ⇅ all_in  openssl x509 -text -noout -in /Users/jojo/.pyenv/versions/beets310/lib/python3.10/site-packages/certifi/cacert.pem
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            04:00:00:00:00:01:15:4b:5a:c3:94
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
        Validity
            Not Before: Sep  1 12:00:00 1998 GMT
            Not After : Jan 28 12:00:00 2028 GMT
        Subject: C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA

[arsaboo]

Can you explicitly add the path to you CA keys - see https://stackoverflow.com/questions/11548336/openssl-verify-return-code-20-unable-to-get-local-issuer-certificate

[JOJ0]

Something like that I have in mind, but I'm trying to find out which CA-Certs are in use and where they live on my system for some time now already. Will read the article you posted! Thanks a lot!

[JOJ0]

I finally got it sorted yesterday. After reinstalling openssl things from homebrew and stuff, I think what was the cure in the end was making sure that my shell-(tools) are using an up to date version of ssl CA certificate. This in .zshrc did the trick:

export SSL_CERT_FILE=/usr/local/etc/openssl@1.1/cert.pem

I am assuming that the /etc/ssl/... things that come with macOS are not updated anymore since macOS 10.15 Catalina is out of Apple's support already (yes I know I should update to a newer macOS - but on the other hand I am very afraid that my 2012 MacBook explodes when I do that!!!!! OMG! good ol' device! No money for a new one!)

Most of all: Many thanks for that article @arsaboo that pointed in exactly the right direction for further digging! Appreciated 👍