ssl certificate verify failed, on freebsd 10.1

[satan1st]

Hello, on FreeBSD youtube-dl fails, if you request a https-site:

[debug] System config: []
[debug] User config: []
[debug] Command-line args: ['-v', '--no-check-certificate', 'http://youtu.be/fNGho63QYT0']
[debug] Encodings: locale UTF-8, fs UTF-8, out None, pref UTF-8
[debug] youtube-dl version 2015.01.25
[debug] Python version 2.7.9 - FreeBSD-10.1-RELEASE-amd64-64bit-ELF
[debug] exe versions: ffmpeg 2.3.6, ffprobe 2.3.6, rtmpdump 2.4
[debug] Proxy map: {}
[youtube] fNGho63QYT0: Downloading webpage
ERROR: Unable to download webpage: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)> (caused by URLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)'),))
  File "/usr/local/bin/youtube-dl/youtube_dl/extractor/common.py", line 299, in _request_webpage
    return self._downloader.urlopen(url_or_request)
  File "/usr/local/bin/youtube-dl/youtube_dl/YoutubeDL.py", line 1571, in urlopen
    return self._opener.open(req, timeout=self._socket_timeout)
  File "/usr/local/lib/python2.7/urllib2.py", line 431, in open
    response = self._open(req, data)
  File "/usr/local/lib/python2.7/urllib2.py", line 449, in _open
    '_open', req)
  File "/usr/local/lib/python2.7/urllib2.py", line 409, in _call_chain
    result = func(*args)
  File "/usr/local/bin/youtube-dl/youtube_dl/utils.py", line 659, in https_open
    req)
  File "/usr/local/lib/python2.7/urllib2.py", line 1197, in do_open
    raise URLError(err)

I have run git bisect and found out the commit be4a824 is the problem.

[k0ral]

I confirm I have the exact same issue here on Linux.

[jaimeMF]

The '--no-check-certificate' should work again with the fix in #4815. But I wouldn't recommend using it.

The problem is that in FreeBSD, the certfiles are not loaded (it happens the same if you run wget "https://youtube.com/...."). Installing the security/ca_root_nss port with the ETCSYMLINK option fix it, the certfiles are loaded (as suggested in this thread in the forums), exporting the environment variable SSL_CERT_FILE as /usr/local/share/certs/ca-root-nss.crt also works.

[satan1st]

I have security/ca_root_nss with ETCSYMLINK installed, but the youtube-dl fails. The workaround with SSL_CERT_FILE works.
This is a general bug of the lang/python27 port in FreeBSD, but thanks for the help.

[jaimeMF]

It works for me with python 2.7.9 with both methods. (I don't use freebsd regularly , I have used a fresh install on a virtual machine). If you think it's a bug on the python port you should report it to them.

@k0ral maybe you should open a new issue with the output of youtube-dl --verbose URL. It would be useful to know which distro you are using (will be printed in the output of the command)