Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upGitHub is where the world builds software
Millions of developers and companies build, ship, and maintain their software on GitHub — the largest and most advanced development platform in the world.
yt-dl.org (YouTube-DL main Hosting Site) broken certificate #25491
Comments
|
yt-dl.org certificate is fine and not expired. You're hit by expired AddTrust External CA Root which is still on your CA store. |
|
@dstftw - Thank you so much for that information. I'm having trouble understanding how to fix it on my end, though. I have some automation which grabs the latest version of YouTube-DL with Ideally I'd like to fix the cert in my local CA store, but I'm having trouble knowing how to do it. Do you have any suggestions? The site that you linked says that the certificate should already be fixed on the operating systems that I'm encountering the issue upon, but clearly it's not fixed there yet. For example, I encounter the error message on these operating systems when I issue the command
The latter one is the primary target for my automation, it's a Synology NAS running a version of GNU Linux, and it's the thing that's failing with the error. I see that others our there are having the same problem as me, for instance this reddit thread is about someone encountering the same thing (no solution there yet). I also see someone describing a fix here at this site, but there are some instructions there which don't apply to me, and so I can't use it as a guide. There is another page here which seems to have a simpler solution that I'll see if I can try. Any other suggestions? |
|
The fix for me for this on debian linux was to:
|
|
@cslycord - Indeed this was the solution described at this web site, but in my case, the Synology machine that's encountering the problem doesn't have a "update-ca-certificates" command to run. So I can't implement that solution. I'm able to edit the file, but then I don't know how to update the CA certificates after editing the file. I've been looking around for a command line parameter for OpenSSL that could do the same thing. For instance, issuing a command like "sudo openssl ca -updatedb", but that one gets an error, and I don't even know if that's barking up the right tree at all. |
|
@tfabris If your machine doesn't have an update-ca-certificates command, then you likely have to install the "ca-certificates" package. |
|
@cslycord - I'm don't think I can install that package on this Synology NAS. For example, "apt-get" doesn't exist on the system either. I have a hunch that there's gotta be a way to fix this from within OpenSSL without having to install extra packages, I just don't know what the procedure is. (Update: https://community.synology.com/enu/forum/17/post/41047 ) |
|
Or better yet, is there a way to work around the issue with the Bash command line when the file is being downloaded? Either with Wget or Curl or something else I have available that doesn't require a package install on that Synology system. My criteria would be:
I don't think this is do-able via simple command lines to wget or curl. Though I think I have an idea. The script that I'm running, which calls wget, could theoretically look at the error text coming back out of wget. If the text exactly matches that one exact "known issue" error message, with no other cert errors, then it could run wget a second time with the cert checking turned off. Doesn't solve the root of the problem, but works around the issue for my particular use-case. |
remove AddTrust entries in /etc/ssl/cert.pem, then we point request to this when making requests. reference https://security.stackexchange.com/questions/232445/https-connection-to-specific-sites-fail-with-curl-on-macos and https://gist.github.com/jmibanez/d3a5c97c44e5077edf00b9b68d60ed25 ytdl-org/youtube-dl#25491
|
I've worked around this issue myself by doing the thing I suggested: In my script, I detect if it gets that exact specific error message, and if so, then it retries the download with cert checking turned off. Works for me for now. |
|
Looks like there is a problem not only with wget under macos&linux (mentioned above), but with ytdl itself under windows. Since about last week, it can`t update itself due to same reasons. |
|
Yeah, this also happens on Windows. I have to use --no-check-certificate with some websites and when checking for updates as a workaround. |
|
I am also having this problem in my very old Debian Jessie v8 box: $ youtube-dl -v -U During handling of the above exception, another exception occurred: Traceback (most recent call last): ERROR: can't find the current version. Please try again later. My friend's Fedora v31 box had no problems. I assume it is very my old OS. :( I had no issues a few days ago too (5/29/2020 18:35:34 [LA, CA, USA time zone]). |
|
FYI. #25491 (comment) for workaround worked. What does this mozilla/AddTrust_External_Root.crt affect for other sites and servers? I hope I can get it back soon. Also, it would be nice if youtube-dl error did not say "ERROR: can't find the current version. Please try again later." which is misleading. It should say your OS needs an updated SSL cerificate or something. |
Your server (yt-dl.org) is sending the expired intermediate cert (the last one in the below openssl output, "COMODO RSA Certification Authority"), which is what's causing validation to fail in python. Browsers are evidently smart enough to ignore it, and build an alternate chain, but the python client is not. |
|
you have to stop sending the expired intermediate cert because your own python client can't handle it https://www.agwa.name/blog/post/fixing_the_addtrust_root_expiration
|
|
I'd argue this issue should be reopened. As it is, I cannot install youtube-dl using the curl or wget commands provided in the download page. With Curl:
With wget:
A workaround that every user needs to apply is not a fix. |
|
I do think it's the bundled Python (urllib?). Even after disabling the AddTrust Root CA certs via Now, building from source in Windows: |
|
This worked for me on Windows hopefully it will help someone else: To get the new AddTrust Certificate so YouTube-DL can update again, in internet explorer to go to: http://testsites.test.certificatetest.com/ and click on https://addtrustexternalcaroot.test.certificatetest.com/ Here is the Verbose output before and after updating the certificate: `
|
|
Any update on this? On a brand new installation of Mojave using the curl command from the download page in Terminal yields the certificate error. |
|
Same problem on mac... |
|
+1 what's going on? :| kind of a big issue for this cert thing to still be throwing errors |
|
Same problem on my raspi (Raspbian Jessie), even after running update-ca-certificates. I worked around this by using the wget download line with --no-check-certificate, but that's not a real fix - please make sure that you use a certificate which is valid out of the box for all OSes including old ones, without requiring users to mess up with CAs. |
Amen. Can this get re-opened? It's certainly still an issue. |
|
This is still a problem on macOS 10.14: Please reopen, or provide a clear work around. |
Checklist
Verbose log
Description
The main site that hosts the download of the YouTube-DL binary program itself, has an expired security certificate. The error message says:
This started occurring on approximately Friday 2020-05-29, though I'm not certain exactly. You can reproduce the issue by typing this command at a bash prompt:
This problem affects me, because I do not want to download and use the latest version of YouTube-DL if there is a security risk on the site hosting it.