<urlopen error [SSL: CERTIFICATE_VERIFY_FAILED]

[tylerfoo]

$ youtube-dl -v -i https://www.youtube.com/watch?v=d7n34bkF-Ew
[debug] System config: []
[debug] User config: ['--proxy', 'http://127.0.0.1:8087', '-o', '~/Downloads/%(title)s.%(ext)s', '-f', '22']
[debug] Command-line args: ['-v', '-i', 'https://www.youtube.com/watch?v=d7n34bkF-Ew']
[debug] Encodings: locale 'UTF-8', fs 'utf-8', out 'UTF-8', pref: 'UTF-8'
[debug] youtube-dl version 2014.03.12
[debug] Python version 3.3.5 - Linux-3.13.7-1-ARCH-x86_64-with-arch
[debug] Proxy map: {'http': 'http://127.0.0.1:8087', 'https': 'http://127.0.0.1:8087'}
[youtube] Setting language
WARNING: unable to set language: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:548)>
[youtube] d7n34bkF-Ew: Downloading webpage
ERROR: Unable to download webpage: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:548)>
  File "/usr/lib/python3.3/site-packages/youtube_dl/extractor/common.py", line 192, in _request_webpage
    return self._downloader.urlopen(url_or_request)
  File "/usr/lib/python3.3/site-packages/youtube_dl/YoutubeDL.py", line 1173, in urlopen
    return self._opener.open(req, timeout=self._socket_timeout)
  File "/usr/lib/python3.3/urllib/request.py", line 469, in open
    response = self._open(req, data)
  File "/usr/lib/python3.3/urllib/request.py", line 487, in _open
    '_open', req)
  File "/usr/lib/python3.3/urllib/request.py", line 447, in _call_chain
    result = func(*args)
  File "/usr/lib/python3.3/urllib/request.py", line 1289, in https_open
    context=self._context, check_hostname=self._check_hostname)
  File "/usr/lib/python3.3/urllib/request.py", line 1251, in do_open
    raise URLError(err)

I think it's related to python3, 'cause when I git cloned this repo and ran it with python2, everything just worked.

[phihag]

Python 2 does not check certificate validity. You can pass in the --no-check-certificate option to skip certificate validation under Python 3 as well. But that's just handling the symptoms, not the cause of your error.

This error indicates that the SSL certificate was incorrect. While it can be caused by misconfiguration, this is a serious issue if you are worried about the privacy or integrity of your video viewing experience.

Does the error occur if you don't pass in a proxy (i.e. add --proxy '' to the command line?) ? What output do get for

echo | openssl s_client -connect youtube.com:443

?

[tylerfoo]

$ youtube-dl -i -v --ignore-config https://www.youtube.com/watch?v=d7n34bkF-Ew
[debug] System config: []
[debug] User config: []
[debug] Command-line args: ['-i', '-v', '--ignore-config', 'https://www.youtube.com/watch?v=d7n34bkF-Ew']
[debug] Encodings: locale 'UTF-8', fs 'utf-8', out 'UTF-8', pref: 'UTF-8'
[debug] youtube-dl version 2014.03.12
[debug] Python version 3.3.5 - Linux-3.13.7-1-ARCH-x86_64-with-arch
[debug] Proxy map: {}
[youtube] Setting language

But pls be noted that if I don't use the '--proxy' option, I don't even have internet access to Youtube.

$ echo | openssl s_client -connect youtube.com:443CONNECTED(00000003)

[tylerfoo]

Forgot to mention I'm using goagent.

[rdp]

as a note, with windows, python 3.3:

c:\downloads>python youtube-dl "https://www.youtube.com/watch?v=Xr9f-hwZAtw" -ci -f best -x --no-mtime --add-metadata
[youtube] Setting language
WARNING: unable to set language: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:548)>
[youtube] Xr9f-hwZAtw: Downloading webpage
ERROR: Unable to download webpage: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:548)>

[schickling]

+1

[wanghwh]

For users who wish to opt out of certificate verification on a single connection, they can achieve this by providing the contextargument to urllib.urlopen :

import ssl  
  
# This restores the same behavior as before.  
context = ssl._create_unverified_context()  
urllib.urlopen("https://no-valid-cert", context=context)  

[yan12125]

As a reference, you'll need --no-check-certificate anyway as GAE-based proxies, including GoAgent and XX-Net, regenerates all SSL certificates.