Windows Server Install: ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate #112

fdcastel · 2023-05-05T19:10:01Z

Related #76 (now closed)

Windows Server 2022 Standard.

PS C:\Users\Administrator> py --version
Python 3.10.11

PS C:\Users\Administrator> pip --version
pip 23.1.2 from C:\Python310\lib\site-packages\pip (python 3.10)

PS C:\Users\Administrator> (Invoke-WebRequest -Uri https://install.python-poetry.org -UseBasicParsing).Content | py -
Retrieving Poetry metadata
Traceback (most recent call last):
  File "C:\Python310\lib\urllib\request.py", line 1348, in do_open
    h.request(req.get_method(), req.selector, req.data, headers,
  File "C:\Python310\lib\http\client.py", line 1283, in request
    self._send_request(method, url, body, headers, encode_chunked)
  File "C:\Python310\lib\http\client.py", line 1329, in _send_request
    self.endheaders(body, encode_chunked=encode_chunked)
  File "C:\Python310\lib\http\client.py", line 1278, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "C:\Python310\lib\http\client.py", line 1038, in _send_output
    self.send(msg)
  File "C:\Python310\lib\http\client.py", line 976, in send
    self.connect()
  File "C:\Python310\lib\http\client.py", line 1455, in connect
    self.sock = self._context.wrap_socket(self.sock,
  File "C:\Python310\lib\ssl.py", line 513, in wrap_socket
    return self.sslsocket_class._create(
  File "C:\Python310\lib\ssl.py", line 1071, in _create
    self.do_handshake()
  File "C:\Python310\lib\ssl.py", line 1342, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 940, in <module>
  File "<stdin>", line 919, in main
  File "<stdin>", line 516, in run
  File "<stdin>", line 775, in get_version
  File "<stdin>", line 836, in _get
  File "C:\Python310\lib\urllib\request.py", line 216, in urlopen
    return opener.open(url, data, timeout)
  File "C:\Python310\lib\urllib\request.py", line 519, in open
    response = self._open(req, data)
  File "C:\Python310\lib\urllib\request.py", line 536, in _open
    result = self._call_chain(self.handle_open, protocol, protocol +
  File "C:\Python310\lib\urllib\request.py", line 496, in _call_chain
    result = func(*args)
  File "C:\Python310\lib\urllib\request.py", line 1391, in https_open
    return self.do_open(http.client.HTTPSConnection, req,
  File "C:\Python310\lib\urllib\request.py", line 1351, in do_open
    raise URLError(err)
urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)>

However, unlike #76, installing certifi package does not solve the problem anymore.

PS C:\Users\Administrator> pip install --upgrade certifi
Collecting certifi
  Using cached certifi-2022.12.7-py3-none-any.whl (155 kB)
Installing collected packages: certifi
Successfully installed certifi-2022.12.7
PS C:\Users\Administrator>

PS C:\Users\Administrator> (Invoke-WebRequest -Uri https://install.python-poetry.org -UseBasicParsing).Content | py -
Retrieving Poetry metadata
Traceback (most recent call last):
  File "C:\Python310\lib\urllib\request.py", line 1348, in do_open
    h.request(req.get_method(), req.selector, req.data, headers,
  File "C:\Python310\lib\http\client.py", line 1283, in request
    self._send_request(method, url, body, headers, encode_chunked)
  File "C:\Python310\lib\http\client.py", line 1329, in _send_request
    self.endheaders(body, encode_chunked=encode_chunked)
  File "C:\Python310\lib\http\client.py", line 1278, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "C:\Python310\lib\http\client.py", line 1038, in _send_output
    self.send(msg)
  File "C:\Python310\lib\http\client.py", line 976, in send
    self.connect()
  File "C:\Python310\lib\http\client.py", line 1455, in connect
    self.sock = self._context.wrap_socket(self.sock,
  File "C:\Python310\lib\ssl.py", line 513, in wrap_socket
    return self.sslsocket_class._create(
  File "C:\Python310\lib\ssl.py", line 1071, in _create
    self.do_handshake()
  File "C:\Python310\lib\ssl.py", line 1342, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 940, in <module>
  File "<stdin>", line 919, in main
  File "<stdin>", line 516, in run
  File "<stdin>", line 775, in get_version
  File "<stdin>", line 836, in _get
  File "C:\Python310\lib\urllib\request.py", line 216, in urlopen
    return opener.open(url, data, timeout)
  File "C:\Python310\lib\urllib\request.py", line 519, in open
    response = self._open(req, data)
  File "C:\Python310\lib\urllib\request.py", line 536, in _open
    result = self._call_chain(self.handle_open, protocol, protocol +
  File "C:\Python310\lib\urllib\request.py", line 496, in _call_chain
    result = func(*args)
  File "C:\Python310\lib\urllib\request.py", line 1391, in https_open
    return self.do_open(http.client.HTTPSConnection, req,
  File "C:\Python310\lib\urllib\request.py", line 1351, in do_open
    raise URLError(err)
urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)>

The text was updated successfully, but these errors were encountered:

geminixiang · 2023-05-20T14:37:06Z

I encountered the same issue on a Mac, and I have already resolved it. However, I haven't tested it on Windows. Here is some information for your reference.

windows

install openssl (Win64 OpenSSL v3.1.0 Light)
https://slproweb.com/products/Win32OpenSSL.html

mac resolve by

sudo /Applications/Python\ 3.11/Install\ Certificates.command

ubuntu (Linux)

sudo update-ca-certificates --fresh
export SSL_CERT_DIR=/etc/ssl/certs

in script

import ssl

ssl._create_default_https_context = ssl._create_unverified_context

fdcastel · 2023-05-27T14:23:13Z

Anyone from poetry team could give me a help about this problem?

If there is no intention to support Windows, please be more clear about it in the documentation.

Otherwise, could someone give some attention to this issue? (a major loss of functionality opened 3 weeks ago?)

Poetry now only work on machines I had installed it a long time ago.
I cannot install it in newer machines.
I cannot upgrade older installs to latest versions.

I don't know what mess Python is doing with certificates (and why it doesn't use the ones installed in the operating system). But I'm surely know this problem may be solved in 5 minutes for anyone who knows what's going on.

My machine CAN download the files. It's just the python script which does not.

radoering · 2023-05-27T14:40:09Z

Maybe, you need pip-system-certs in your C:\Python310 environment.

fdcastel · 2023-05-28T11:28:07Z

Thanks @radoering . Unfortunately the problem persists.

I've installed it with

PS C:\> pip install pip-system-certs
Collecting pip-system-certs
  Using cached pip_system_certs-4.0-py2.py3-none-any.whl (6.1 kB)
Requirement already satisfied: wrapt>=1.10.4 in c:\python310\lib\site-packages (from pip-system-certs) (1.15.0)
Installing collected packages: pip-system-certs
Successfully installed pip-system-certs-4.0

But poetry installer keeps giving me the same error:

PS C:\> (Invoke-WebRequest -Uri https://install.python-poetry.org -UseBasicParsing).Content | py -
Retrieving Poetry metadata
Traceback (most recent call last):
  File "C:\Python310\lib\urllib\request.py", line 1348, in do_open
    h.request(req.get_method(), req.selector, req.data, headers,
  File "C:\Python310\lib\http\client.py", line 1283, in request
    self._send_request(method, url, body, headers, encode_chunked)
  File "C:\Python310\lib\http\client.py", line 1329, in _send_request
    self.endheaders(body, encode_chunked=encode_chunked)
  File "C:\Python310\lib\http\client.py", line 1278, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "C:\Python310\lib\http\client.py", line 1038, in _send_output
    self.send(msg)
  File "C:\Python310\lib\http\client.py", line 976, in send
    self.connect()
  File "C:\Python310\lib\http\client.py", line 1455, in connect
    self.sock = self._context.wrap_socket(self.sock,
  File "C:\Python310\lib\ssl.py", line 513, in wrap_socket
    return self.sslsocket_class._create(
  File "C:\Python310\lib\ssl.py", line 1071, in _create
    self.do_handshake()
  File "C:\Python310\lib\ssl.py", line 1342, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 945, in <module>
  File "<stdin>", line 923, in main
  File "<stdin>", line 524, in run
  File "<stdin>", line 786, in get_version
  File "<stdin>", line 847, in _get
  File "C:\Python310\lib\urllib\request.py", line 216, in urlopen
    return opener.open(url, data, timeout)
  File "C:\Python310\lib\urllib\request.py", line 519, in open
    response = self._open(req, data)
  File "C:\Python310\lib\urllib\request.py", line 536, in _open
    result = self._call_chain(self.handle_open, protocol, protocol +
  File "C:\Python310\lib\urllib\request.py", line 496, in _call_chain
    result = func(*args)
  File "C:\Python310\lib\urllib\request.py", line 1391, in https_open
    return self.do_open(http.client.HTTPSConnection, req,
  File "C:\Python310\lib\urllib\request.py", line 1351, in do_open
    raise URLError(err)
urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)>

Worse. I did notice that this package affected the entire pip ability to download anything:

PS C:\> pip install numpy
WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)'))': /simple/numpy/
WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)'))': /simple/numpy/
WARNING: Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)'))': /simple/numpy/
WARNING: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)'))': /simple/numpy/
WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)'))': /simple/numpy/
Could not fetch URL https://pypi.org/simple/numpy/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/numpy/ (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)'))) - skipping
ERROR: Could not find a version that satisfies the requirement numpy (from versions: none)
ERROR: No matching distribution found for numpy

PS C:\> python.exe -m pip install --upgrade pip
Requirement already satisfied: pip in c:\python310\lib\site-packages (23.1.2)
WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)'))': /simple/pip/
WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)'))': /simple/pip/
WARNING: Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)'))': /simple/pip/
WARNING: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)'))': /simple/pip/
WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)'))': /simple/pip/
Could not fetch URL https://pypi.org/simple/pip/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/pip/ (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)'))) - skipping

Uninstalling pip-system-certs did solve this problem:

PS C:\> pip uninstall pip-system-certs
Found existing installation: pip-system-certs 4.0
Uninstalling pip-system-certs-4.0:
  Would remove:
    c:\python310\lib\site-packages\pip_system_certs-4.0.dist-info\*
    c:\python310\lib\site-packages\pip_system_certs.pth
    c:\python310\lib\site-packages\pip_system_certs\*
Proceed (Y/n)? y
  Successfully uninstalled pip-system-certs-4.0

PS C:\> pip install numpy
Collecting numpy
  Downloading numpy-1.24.3-cp310-cp310-win_amd64.whl (14.8 MB)
     ---------------------------------------- 14.8/14.8 MB 6.4 MB/s eta 0:00:00
Installing collected packages: numpy
Successfully installed numpy-1.24.3

PS C:\> python.exe -m pip install --upgrade pip
Requirement already satisfied: pip in c:\python310\lib\site-packages (23.1.2)

But poetry installer still gives the same error.

These tests were done in a clean VM with Windows Server 2022 Standard installed.

fdcastel · 2023-05-30T18:09:14Z

To anyone needing this, I made a fork from installation script disabling SSL certification validation:

https://github.com/fdcastel/install-poetry

(Invoke-WebRequest -Uri https://raw.githubusercontent.com/fdcastel/install-poetry/main/install-poetry.py -UseBasicParsing).Content | py -

dbernstein-pallidus · 2023-06-19T15:57:02Z

Having the same problem, we cannot install poetry on new windows machines.

rukiyeaslan · 2023-06-28T14:32:02Z

I was facing the same problem on mac and any of the solutions I found didn't work. However, I could install it using the following command (which is also on their website):

curl -sSL https://install.python-poetry.org | python3 - --git https://github.com/python-poetry/poetry.git@master

spoorthykakarla28 · 2023-07-18T17:37:04Z

I have the same issue with windows. Unable to install Poetry.

alexchandel · 2023-08-14T21:40:25Z

To anyone needing this, I made a fork from installation script disabling SSL certification validation:

https://github.com/fdcastel/install-poetry
(Invoke-WebRequest -Uri https://raw.githubusercontent.com/fdcastel/install-poetry/main/install-poetry.py -UseBasicParsing).Content | py -

Insane that this is necessary.

This issue is also related to #118.

This could be fixed with a normal installation method, instead of slurping a powerscript file from the internet.

alexchandel · 2023-08-14T21:42:04Z

FYI this issue would be resolved forever by #129

Wiem657 · 2023-09-27T13:08:47Z

import paho.mqtt.client as mqtt
import logging
import certifi

print(certifi.where())

-MQTT broker settings
broker_address = "qa-iot.valeopaak.com"
port = 1883 # Default port for MQTT over SSL/TLS

-Paths to certificate files (replace with your own paths)
ca_cert = "../certs/iot_ca_bundled.pem" # CA certificate
client_cert = "../certs/iot_car02_crt.pem" # Client certificate
client_key = "../certs/iot_car02_key.pem" # Client private key

logging.basicConfig(level=logging.DEBUG)

-Create an MQTT client instance
client = mqtt.Client()

-Set the TLS/SSL options
client.tls_set(ca_certs=ca_cert, certfile=client_cert, keyfile=client_key)

-Define callback functions (e.g., on_connect, on_message)
def on_connect(client, userdata, flags, rc):
if rc == 0:
print("Connected to MQTT broker")
else:
print(f"Connection failed with code {rc}")

-Set the callback functions
client.on_connect = on_connect

-Connect to the MQTT broker
client.connect(broker_address, port)

-Start the MQTT client loop
client.loop_start()

runnig this script, I got this issue
PS C:\Users\whajali\Desktop\project\PyCANoe_MQTT - Copie> & "c:/Users/whajali/Desktop/project/PyCANoe_MQTT - Copie/venv/Scripts/python.exe" "c:/Users/whajali/Desktop/project/PyCANoe_MQTT - Copie/qa_broker_connection.py"
C:\Users\whajali\Desktop\project\PyCANoe_MQTT - Copie\venv\Lib\site-packages\certifi\cacert.pem
Traceback (most recent call last):
File "c:\Users\whajali\Desktop\project\PyCANoe_MQTT - Copie\qa_broker_connection.py", line 42, in
client.connect(broker_address, port)
File "C:\Users\whajali\Desktop\project\PyCANoe_MQTT - Copie\venv\Lib\site-packages\paho\mqtt\client.py", line 914, in connect
handshake()
handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unsupported certificate purpose (_ssl.c:1002)

ling1042133624 · 2024-01-24T01:28:46Z

I encountered the same issue on a Mac, and I have already resolved it. However, I haven't tested it on Windows. Here is some information for your reference.

windows

install openssl (Win64 OpenSSL v3.1.0 Light)
https://slproweb.com/products/Win32OpenSSL.html

mac resolve by
sudo /Applications/Python\ 3.11/Install\ Certificates.command
ubuntu (Linux)
sudo update-ca-certificates --fresh
export SSL_CERT_DIR=/etc/ssl/certs
in script
import ssl

ssl._create_default_https_context = ssl._create_unverified_context

Not useful in ubuntu

mattipaivikeeee · 2024-05-27T06:46:58Z

Freshly installed Windows 10 machine and I have the same issue. Why isn't this fixed?

fdcastel · 2024-05-27T08:22:52Z

Freshly installed Windows 10 machine and I have the same issue. Why isn't this fixed?

Maybe poetry developers don't speak English. Or they just don't like Windows. Who knows?

But, here! Take a slice:

🎂 Python Poetry Installer (for Windows) -- Anniversary Edition 🎂

Secrus · 2024-05-27T09:14:55Z

Freshly installed Windows 10 machine and I have the same issue. Why isn't this fixed?

This is not fixed because there is no good fix for this issue that would be cross-platform and safe (disabling ssl is not safe). If someone will figure out how to work around this issue, we will be happy to accept a PR.

dimbleby mentioned this issue May 18, 2023

ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] while installing poetry python-poetry/poetry#7946

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Windows Server Install: ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate #112

Windows Server Install: ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate #112

fdcastel commented May 5, 2023

geminixiang commented May 20, 2023 •

edited

fdcastel commented May 27, 2023

radoering commented May 27, 2023

fdcastel commented May 28, 2023

fdcastel commented May 30, 2023

dbernstein-pallidus commented Jun 19, 2023

rukiyeaslan commented Jun 28, 2023 •

edited

spoorthykakarla28 commented Jul 18, 2023

alexchandel commented Aug 14, 2023

alexchandel commented Aug 14, 2023

Wiem657 commented Sep 27, 2023

ling1042133624 commented Jan 24, 2024

mattipaivikeeee commented May 27, 2024

fdcastel commented May 27, 2024

Secrus commented May 27, 2024

Windows Server Install: ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate #112

Windows Server Install: ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate #112

Comments

fdcastel commented May 5, 2023

geminixiang commented May 20, 2023 • edited

fdcastel commented May 27, 2023

radoering commented May 27, 2023

fdcastel commented May 28, 2023

fdcastel commented May 30, 2023

dbernstein-pallidus commented Jun 19, 2023

rukiyeaslan commented Jun 28, 2023 • edited

spoorthykakarla28 commented Jul 18, 2023

alexchandel commented Aug 14, 2023

alexchandel commented Aug 14, 2023

Wiem657 commented Sep 27, 2023

ling1042133624 commented Jan 24, 2024

mattipaivikeeee commented May 27, 2024

fdcastel commented May 27, 2024

Secrus commented May 27, 2024

geminixiang commented May 20, 2023 •

edited

rukiyeaslan commented Jun 28, 2023 •

edited