Get SSL failure when trying to download video from facebook.

[shirishag75]

Hi all,
I have been trying to download fb videos. When asking to see which streams are downloadable it's all good :-

[$] youtube-dl -F "https://www.facebook.com/video.php?v=785520541528967"                                                     
[facebook] 785520541528967: Downloading webpage
[info] Available formats for 785520541528967:
format code  extension  resolution note
sd           mp4        unknown    
hd           mp4        unknown    (best)    

But when I am actually trying to download the video in question I get the following :-

  [$] youtube-dl -v -u 'private' -p 'private' -f hd "http://www.facebook.com/video.php?v=785520541528967"       [17:15:56]
[debug] System config: []
[debug] User config: []
[debug] Command-line args: ['-v', '-u', u'PRIVATE', '-p', u'PRIVATE', '-f', 'hd', 'http://www.facebook.com/video.php?v=785520541528967']
[debug] Encodings: locale UTF-8, fs UTF-8, out UTF-8, pref UTF-8
[debug] youtube-dl version 2015.02.28
[debug] Python version 2.7.9 - Linux-3.16.0-4-amd64-x86_64-with-debian-8.0
[debug] exe versions: avconv 11.3-6, avprobe 11.3-6, rtmpdump 2.4
[debug] Proxy map: {}
[facebook] Downloading login page
[facebook] Logging in
[facebook] Confirming login
[facebook] 785520541528967: Downloading webpage
[debug] Invoking downloader on u'https://fbcdn-video-h-a.akamaihd.net/hvideo-ak-xfp1/v/t43.1792-2/11044001_785526411528380_2033975173_n.mp4?efg=big_alphanumeric-sequence&rl=2046&vabr=1364&oh=big_alphanumeric_sequence=55082B9E&__gda__=big_alphanumeric_sequence'
ERROR: unable to download video data: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)>
Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/youtube_dl/YoutubeDL.py", line 1375, in process_info
    success = dl(filename, info_dict)
  File "/usr/lib/python2.7/dist-packages/youtube_dl/YoutubeDL.py", line 1350, in dl
    return fd.download(name, info)
  File "/usr/lib/python2.7/dist-packages/youtube_dl/downloader/common.py", line 339, in download
    return self.real_download(filename, info_dict)
  File "/usr/lib/python2.7/dist-packages/youtube_dl/downloader/http.py", line 64, in real_download
    data = self.ydl.urlopen(request)
  File "/usr/lib/python2.7/dist-packages/youtube_dl/YoutubeDL.py", line 1666, in urlopen
    return self._opener.open(req, timeout=self._socket_timeout)
  File "/usr/lib/python2.7/urllib2.py", line 431, in open
    response = self._open(req, data)
  File "/usr/lib/python2.7/urllib2.py", line 449, in _open
    '_open', req)
  File "/usr/lib/python2.7/urllib2.py", line 409, in _call_chain
    result = func(*args)
  File "/usr/lib/python2.7/dist-packages/youtube_dl/utils.py", line 673, in https_open
    req, **kwargs)
  File "/usr/lib/python2.7/urllib2.py", line 1197, in do_open
    raise URLError(err)
URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)>

Now the changes I have made is in the alphanumeric sequences which it tells/shares when the downloader is invoked, whether those are cookies or something which identifies me is not known to me hence not sharing that. Obviously username and password are also marked as 'private'. Any ideas anybody ?

[jaimeMF]

It works for me, could you try the following (you can get the video url with youtube-dl 'http://www.facebook.com/video.php?v=785520541528967' -g):

• Can you download it with something like curl/wget? (just run curl -o video.mp4 <video_url> or wget -O video.mp4 <video_url>.
• Can you access the video url using a web browser?

[oneplusme]

I have the same issue (with a public video). wget reports:

Connecting to fbcdn-video-i-a.akamaihd.net (fbcdn-video-i-a.akamaihd.net)|88.221.89.48|:443... connected.
ERROR: cannot verify fbcdn-video-i-a.akamaihd.net's certificate, issued by ‘CN=Cybertrust Public SureServer SV CA,O=Cybertrust Inc’:
Unable to locally verify the issuer's authority.
To connect to fbcdn-video-i-a.akamaihd.net insecurely, use `--no-check-certificate'.

Using the "--no-check-certificate" option to youtube-dl or wget works around the problem.

[shirishag75]

Yes with the --no-check-certificate workaround it works :-

[$]  youtube-dl -f hd --no-check-certificate "https://www.facebook.com/video.php?v=785520541528967"                                 [3:12:21]
[facebook] 785520541528967: Downloading webpage
[download] Destination: Jeffrey & Jomy Live in Sydney - Come and see us..-785520541528967.mp4
[download]  36.6% of 8.37MiB at 57.83KiB/s ETA 01:34

But it needs this workaround otherwise it asks for certificate each time. Both while either using wget or curl.

[$] curl -o video.mp4 https://fbcdn-video-h-a.akamaihd.net/hvideo-ak-xfp1/v/t43.1792-2/11044001_785526411528380_2033975173_n.mp4    [3:10:41]
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

With wget get this :-

   [$] wget -O video.mp4 https://fbcdn-video-h-a.akamaihd.net/hvideo-ak-xfp1/v/t43.1792-2/11044001_785526411528380_2033975173_n.mp4    [3:10:55]
--2015-03-26 03:11:18--  https://fbcdn-video-h-a.akamaihd.net/hvideo-ak-xfp1/v/t43.1792-2/11044001_785526411528380_2033975173_n.mp4
Resolving fbcdn-video-h-a.akamaihd.net (fbcdn-video-h-a.akamaihd.net)... 115.112.4.6
Connecting to fbcdn-video-h-a.akamaihd.net (fbcdn-video-h-a.akamaihd.net)|115.112.4.6|:443... connected.
HTTP request sent, awaiting response... 403 Forbidden
2015-03-26 03:11:18 ERROR 403: Forbidden.

[jaimeMF]

I guess that curl, wget and python haven't been properly configured to use the certificates. Setting the SSL_CERT_FILE environment variable to the path containing the cert file may fix it (it works in FreeBSD), but someone using Debian may give you a better advice.

@shirishag75 wget seems to be correctly using the certificates, but you need to pass the full url (with all the stuff after the .mp4?).

[shirishag75]

@jaimeMF you are correct, with the full url it works. Will ask people for ssl_cert_file environment variable.

[jaimeMF]

I'm closing the issue, since it's not a youtube-dl bug. You may want to look into the ca-certificates package.

[shirishag75]

I do have that installed but for some reason it doesn't work. Btw it seems even vimeo has the same issue.

[$] youtube-dl -f h264-hd "http://vimeo.com/58062990"                                                                               [6:21:10]
[vimeo] 58062990: Downloading webpage
[vimeo] 58062990: Extracting information
[vimeo] 58062990: Downloading webpage
ERROR: unable to download video data: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)>

and without the check for the certificate :-

[$] youtube-dl -f h264-hd --no-check-certificate "http://vimeo.com/58062990"                                                        [6:21:21]
[vimeo] 58062990: Downloading webpage
[vimeo] 58062990: Extracting information
[vimeo] 58062990: Downloading webpage
[download] Destination: Spantree - Getting Started with Elasticsearch-58062990.mp4
[download] 27.5% of of 30.79MiB at 50.95KiB/s ETA 7:05

[jaimeMF]

And every website that forces the use of https (like YouTube itslef) will probably fail, I'll try to reproduce the error in a virtual machine.
I would try to avoid using the --no-check-certificate option, it's insecure.

[jaimeMF]

I installed debian jessie in a VM and I could only reproduce the issue if set the SSL_CERT_DIR environment variable to '' (with export SSL_CERT_DIR='').