The certificate https://version.qgis.org/version.txt not found

[NLD-ITService]

What is the bug or the crash?

When running QGIS Desktop 3.16.0 a message appears "SSL error: https://version.qgis.org/version.txt The certificate of the issuer of a locally found certificate could not be found".

If ignored, the application works.

Steps to reproduce the issue

Running QGIS Desktop 3.16.0

Versions

QGIS Desktop 3.16.0

Supported QGIS version

• I'm running a supported QGIS version according to the roadmap.

New profile

• I tried with a new QGIS profile

Additional context

I just wanted to ask. Is it just about renewing the website's security certificate? And that's why the message won't appear again soon?
Or is there a reason for concern since it would already be a security issue?

[gioman]

@NLD-ITService duplicate of #45011 ?

QGIS Desktop 3.16.0

this is very old, reports/issues must be tested on current versions, as you stated by checking the checkbox " I'm running a supported QGIS version according to the roadmap.".

[NLD-ITService]

First of all, thank you for your reaction. The same message also appears on version 3.16.11.

[NLD-ITService]

But this version should work.When the system tries to access the certificate, I assume the certificate should be there.

[NLD-ITService]

Thanks in advance

[pathmapper]

@NLD-ITService assuming you are on Windows, could you please check that you have all available Windows Updates installed?

[NLD-ITService]

@pathmapper
We work with Windows 10 and use a WSUS in our Windows environment. All current Windows cumulative uptades are installed.

[NLD-ITService]

@gioman
Dear Giovanni,

I specifically installed version 3.16.11 on a test PC. At least when starting, I manage to see.
"https://version.qgis.org/version.txt
Cannot get local issuer certificate: The certificate of the issuer of a locally found certificate could not be found."

Im Browser bekomme ich auf "https://version.qgis.org/version.txt".

Are you suggesting that 3.16 will remain "unsafe". So without a security certificate?

[gioman]

Are you suggesting that 3.16 will remain "unsafe". So without a security certificate?

@NLD-ITService I'm not suggesting or imply anything, I'm just saying that bug reports must be done after having tested with the current supported releases.

[NLD-ITService]

@gioman
Thanks for the answer.
Good. I tested with the "current" version 3.16.11. The message exists.

I ask you to help us to continue to work securely with QGIS.

[gioman]

I ask you to help us to continue to work securely with QGIS.

@NLD-ITService this has already been reported (and fixed) here #45011

Is to be seen why you still get the message.

[gioman]

Seems a different issue #45011 (comment) thanks @agiudiceandrea

[NLD-ITService]

I have just installed and run version 3.20.3 on a PC.
The problem is the same - both certificates cannot be found.
https://version.qgis.org/
and https://version.qgis.org/.

So the problem is version regardless.

[andreasneumann]

This must be a local issue (some mal-functioning ssl certificate cache or similar). I just checked with multiple providers and QGIS / browsers. The certificates are fine. They expire next on November 9 2021 for https://feed.qgis.org/ and December 9 for https://version.qgis.org/ - the relatively short expiration dates are normal with Let's Encrypt. They are renewed quite often.

[agiudiceandrea]

The issue doesn't occur on my Windows 10 Home 1903 64 bit using QGIS 3.16.11 (from both OSGeo4W v1 and v2 repository) and QGIS 3.20.3.

[andreasneumann]

@NLD-ITService - can you please check what you get, when you open the certificate of https://version.qgis.org/version.txt in your web browser?

Do you get something like this: ?

with an expiration date of December 9 2021 ?

If not, then I suspect you have an issue with your root certificates in your organization.

[NLD-ITService]

@andreasneumann
Browser shows that the https://version.qgis.org certificate is valid until December 9th, 2021.

https://feed.qgis.org/

[agiudiceandrea]

Hi @andreasneumann, the issue is not in the validity of the version.qgis.org certificate itself, but it's due the fact that the root or intermediate digital certificate used to sign the version.qgis.org certificate seems to be missing in the local digital certificate file used by the user system.

[NLD-ITService]

Maybe I should ask another question about this.
As I have already written, the message about the "missing certificate" can be clicked away and QGIS starts without problems.
To what extent is it problematic if the work in QGIS is continued with "missing certificate"? Could this cause any serious errors?

[andreasneumann]

Hi @andreasneumann, the issue is not in the validity of the version.qgis.org certificate itself, but it's due the fact that the root or intermediate digital certificate used to sign the version.qgis.org certificate seems to be missing in the local digital certificate file used by the user system.

You mean that the Windows system used in this installation doesn't know about the Let's Encrypt root certificate?

If that is the case, then there is nothing that QGIS can do about it, I think. Then the Windows would have to be upgraded.

@NLD-ITService - for you the error message indicates that something "fishy" goes on with the communication between QGIS client and the QGIS servers. It doesn't harm your data or so. You are then just communicating with the servers unencrypted (like http and not https). And if something really serious would be going on (e.g. some hack on the QGIS infrastructure) you probably wouldn't notice it, because you are used to click away this warning ...

[andreasneumann]

@NLD-ITService - or couldn't you solve this issue by asking your admins to install the Let's encrypt root certificate in the windows system?

https://letsencrypt.org/docs/certificate-compatibility/ indicated that Windows should be compatible with Let's Encrypt - assuming Automatic Root Certificate Update isn’t manually disabled)

[pathmapper]

I noticed this issue on three different Windows 10 machines and after updating the OS using the standard Windows Update functionality everything is fine again. I suspect this has to do something with the OS root certificates and nothing with QGIS.

[NLD-ITService]

@andreasneumann & @pathmapper Thanks for your comments.
I will contact you as soon as we have solved the problem.

[andreasneumann]

@NLD-ITService - apparently, web browser run their own OS independent certification system, but QGIS is relying on the one provided by the operating system. This is explains, why the certificates are ok in your browser (screenshots above).

[pathmapper]

https://www.techradar.com/news/slack-down-top-websites-see-outages-as-lets-encrypts-ca-certificate-expires

The solution is for servers to move to newer certificates (which have been available from Let's Encrypt for some time now) and for clients to get updates such that they trust newer certificates.

[HusseinKabbout]

On my windows machine, which has the latest windows updates, I also encounter this problem. When I check the default paths for the python SSL lib i get the following:

import ssl
ssl.get_default_verify_paths()
DefaultVerifyPaths(cafile=None, capath=None, openssl_cafile_env='SSL_CERT_FILE', openssl_cafile='D:\\src\\osgeo4w\\src\\openssl\\osgeo4w\\install\\apps\\openssl/cert.pem', openssl_capath_env='SSL_CERT_DIR', openssl_capath='D:\\src\\osgeo4w\\src\\openssl\\osgeo4w\\install\\apps\\openssl/certs')

This seems very odd to me, because I installed QGIS via the standalone installer and also the path D:\src does not exist on my machine.

Now using the current master of QGIS, if I set the env variable SSL_CERT_FILE to D:\QGIS\apps\Python39\Lib\site-packages\certifi\cacert.pem, then the problems seems to be fixed. This however does not work for the current QGIS releases: QGIS 3.20.3 'Odense' and QGIS 3.16.11 'Hannover'.

I don't know if this is of any help, but I thought I would share my findings.

[agiudiceandrea]

@HusseinKabbout thanks for sharing your findings.

I'm not sure if it could be the culprit of this specific issue, because the issue doesn't occur on my Windows 10 Home 1903 64 bit using QGIS 3.16.11 (from both OSGeo4W v1 and v2 repository) and QGIS 3.20.3 installed using the standalone installers as you, and pathmapper reported that in three different Windows 10 machines "after updating the OS using the standard Windows Update functionality everything is fine again".

Anyway I think you spotted a packaging bug of the OSGeo4W building/packaging system that is worth to be reported in the https://trac.osgeo.org/osgeo4w/ issue tracking system: https://trac.osgeo.org/osgeo4w/ticket/696

[agiudiceandrea]

@HusseinKabbout see jef-n/OSGeo4W@041537b and the new openssl package version 1.1.1l-2

[alexbruy]

As I understand this is not directly a QGIS issue. Can we close this? I can't reprocude with the latest LTR and master on Windows 10.

[github-actions]

The QGIS project highly values your report and would love to see it addressed. However, this issue has been left in feedback mode for the last 14 days and is being automatically marked as "stale".
If you would like to continue with this issue, please provide any missing information or answer any open questions. If you could resolve the issue yourself meanwhile, please leave a note for future readers with the same problem and close the issue.
In case you should have any uncertainty, please leave a comment and we will be happy to help you proceed with this issue.
If there is no further activity on this issue, it will be closed in a week.

[github-actions]

While we hate to see this happen, this issue has been automatically closed because it has not had any activity in the last 42 days despite being marked as feedback. If this issue should be reconsidered, please follow the guidelines in the previous comment and reopen this issue.
Or, if you have any further questions, there are also further support channels that can help you.