[Broken] FranceTV: SSL error

[Shoqapik]

Checklist

• I'm reporting a broken site support
• I've verified that I'm running yt-dlp version 2021.10.10
• I've checked that all provided URLs are alive and playable in a browser
• I've checked that all URLs and arguments with special characters are properly quoted or escaped
• I've searched the bugtracker for similar issues including closed ones
• I've read the opening an issue section in CONTRIBUTING.md
• I have given an appropriate title to the issue

Verbose log

[debug] Command-line config: ['-v', 'yt-dlp', 'https://www.france.tv/slash/stalk/saison-2/2827381-r-i-p-stalker-s-hunters.html']
[debug] Encodings: locale cp1252, fs utf-8, out utf-8, pref cp1252
[debug] yt-dlp version 2021.10.10
[debug] Python version 3.9.5 (CPython 64bit) - Windows-10-10.0.19042-SP0
[debug] exe versions: none
[debug] Optional libraries: Cryptodome, mutagen, sqlite, websockets
[debug] ANSI escape support: stdout = True, stderr = True
[debug] Proxy map: {}
[debug] [generic] Extracting URL: yt-dlp
ERROR: [generic] 'yt-dlp' is not a valid URL. Set --default-search "ytsearch" (or run  yt-dlp "ytsearch:yt-dlp" ) to search YouTube
Traceback (most recent call last):
  File "c:\users\asus\appdata\local\programs\python\python39\lib\site-packages\yt_dlp\extractor\common.py", line 589, in extract
    ie_result = self._real_extract(url)
  File "c:\users\asus\appdata\local\programs\python\python39\lib\site-packages\yt_dlp\extractor\generic.py", line 2490, in _real_extract
    raise ExtractorError(
yt_dlp.utils.ExtractorError: 'yt-dlp' is not a valid URL. Set --default-search "ytsearch" (or run  yt-dlp "ytsearch:yt-dlp" ) to search YouTube
Traceback (most recent call last):
  File "c:\users\asus\appdata\local\programs\python\python39\lib\site-packages\yt_dlp\extractor\common.py", line 589, in extract
    ie_result = self._real_extract(url)
  File "c:\users\asus\appdata\local\programs\python\python39\lib\site-packages\yt_dlp\extractor\generic.py", line 2490, in _real_extract
    raise ExtractorError(
yt_dlp.utils.ExtractorError: 'yt-dlp' is not a valid URL. Set --default-search "ytsearch" (or run  yt-dlp "ytsearch:yt-dlp" ) to search YouTube

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "c:\users\asus\appdata\local\programs\python\python39\lib\site-packages\yt_dlp\YoutubeDL.py", line 1263, in wrapper
    return func(self, *args, **kwargs)
  File "c:\users\asus\appdata\local\programs\python\python39\lib\site-packages\yt_dlp\YoutubeDL.py", line 1288, in __extract_info
    ie_result = ie.extract(url)
  File "c:\users\asus\appdata\local\programs\python\python39\lib\site-packages\yt_dlp\extractor\common.py", line 605, in extract
    raise ExtractorError(
yt_dlp.utils.ExtractorError: [generic] 'yt-dlp' is not a valid URL. Set --default-search "ytsearch" (or run  yt-dlp "ytsearch:yt-dlp" ) to search YouTube

[debug] [FranceTVSite] Extracting URL: https://www.france.tv/slash/stalk/saison-2/2827381-r-i-p-stalker-s-hunters.html
[FranceTVSite] 2827381-r-i-p-stalker-s-hunters: Downloading webpage
ERROR: [FranceTVSite] 2827381-r-i-p-stalker-s-hunters: Unable to download webpage: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)> (caused by URLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)')))
  File "c:\users\asus\appdata\local\programs\python\python39\lib\site-packages\yt_dlp\extractor\common.py", line 698, in _request_webpage
    return self._downloader.urlopen(url_or_request)
  File "c:\users\asus\appdata\local\programs\python\python39\lib\site-packages\yt_dlp\YoutubeDL.py", line 3228, in urlopen
    return self._opener.open(req, timeout=self._socket_timeout)
  File "c:\users\asus\appdata\local\programs\python\python39\lib\urllib\request.py", line 517, in open
    response = self._open(req, data)
  File "c:\users\asus\appdata\local\programs\python\python39\lib\urllib\request.py", line 534, in _open
    result = self._call_chain(self.handle_open, protocol, protocol +
  File "c:\users\asus\appdata\local\programs\python\python39\lib\urllib\request.py", line 494, in _call_chain
    result = func(*args)
  File "c:\users\asus\appdata\local\programs\python\python39\lib\site-packages\yt_dlp\utils.py", line 2849, in https_open
    return self.do_open(functools.partial(
  File "c:\users\asus\appdata\local\programs\python\python39\lib\urllib\request.py", line 1349, in do_open
    raise URLError(err)

Description

When wanting to download a recent html video, SSL fails to verify.
It specifically says:
[FranceTVSite] 2827381-r-i-p-stalker-s-hunters: Unable to download webpage: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)> (caused by URLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)')))

[pukkandan]

The certificate store in your system is out of date for some reason. Try running with --no-check-certificates

[Shoqapik]

It worked! Thanks a lot
Continue, you help so many people!

[desseim]

For those who would rather not bypass SSL verification:
This is most likely due to Let's Encrypt (who issues the certificate for this domain) having recently moved their root certificate from DST Root CA X3 to ISRG Root X1, and the DST Root CA X3 certificate having expired on 2021/09/30.

Somehow a machine having the current valid ISRG Root X1 certificate should be able to verify the new certificate of this domain, but I have seen the error occur on such a Windows machine for some reason.
It was solved by deleting the expired DST Root CA X3 certificates using certmgr.msc.

Meanwhile on another similar Windows machine it was verifying the new certificate without problem. On the machine where the error occurred it had 4 DST Root CA X3 certificates, while on the machine where it worked it had only 2 of them ; I guess 2 of the 4 expired certificates where taking precedence for SSL verification over the ISRG Root X1 ones for some reason, but I couldn't investigate further.