SSL: CERTIFICATE_VERIFY_FAILED? #5317

shelbyKiraM · 2015-03-29T20:26:16Z

$ youtube-dl https://www.youtube.com/watch\?v\=WBsyc139pvA
[youtube] WBsyc139pvA: Downloading webpage
ERROR: Unable to download webpage: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)> (caused by URLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)'),))

yan12125 · 2015-03-29T20:41:24Z

It's an old problem. See https://github.com/rg3/youtube-dl/search?q=CERTIFICATE_VERIFY_FAILED&type=Issues&utf8=%E2%9C%93 for previous discussions.

shelbyKiraM · 2015-03-29T20:49:46Z

--no-check-certificate works. Thx. But, you can't fallback to that if it errors?

jaimeMF · 2015-03-29T20:51:10Z

Post the full output with the --verbose option. If you are not using Windows I would appreciate if you could post the output of wget https://www.youtube.com/watch\?v\=WBsyc139pvA and curl -v https://www.youtube.com/watch\?v\=WBsyc139pvA > /dev/null (to see if they also fail).

--no-check-certificate works. Thx. But, you can't fallback to that if it errors?

It's unsecure, and it seems to be required because of a misconfiguration.

shelbyKiraM · 2015-03-29T21:47:43Z

wget https://www.youtube.com/watch\?v\=WBsyc139pvA
--2015-03-29 14:43:50--  https://www.youtube.com/watch?v=WBsyc139pvA
Resolving www.youtube.com... 216.58.192.14, 2607:f8b0:4005:801::200e
Connecting to www.youtube.com|216.58.192.14|:443... connected.
ERROR: cannot verify www.youtube.com's certificate, issued by 'CN=Google Internet Authority G2,O=Google Inc,C=US':
  Unable to locally verify the issuer's authority.
To connect to www.youtube.com insecurely, use `--no-check-certificate'.

curl -v https://www.youtube.com/watch\?v\=WBsyc139pvA > /dev/null                                                                                                                                                                                                                  5 ↵
* Hostname was NOT found in DNS cache
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 216.58.192.14...
*   Trying 2607:f8b0:4005:801::200e...
* Immediate connect fail for 2607:f8b0:4005:801::200e: No route to host
* Connected to www.youtube.com (216.58.192.14) port 443 (#0)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
* Server certificate: *.google.com
* Server certificate: Google Internet Authority G2
* Server certificate: GeoTrust Global CA
> GET /watch?v=WBsyc139pvA HTTP/1.1
> User-Agent: curl/7.37.1
> Host: www.youtube.com
> Accept: */*
>
< HTTP/1.1 200 OK
< Date: Sun, 29 Mar 2015 21:44:57 GMT
* Server gwiseguy/2.0 is not blacklisted
< Server: gwiseguy/2.0
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block; report=https://www.google.com/appserve/security-bugs/log/youtube
< Cache-Control: no-cache
< Content-Type: text/html; charset=utf-8
< P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
< Expires: Tue, 27 Apr 1971 19:44:06 EST
< X-Frame-Options: SAMEORIGIN
< Set-Cookie: YSC=Iwm-_Uh8BVA; path=/; domain=.youtube.com; HttpOnly
< Set-Cookie: VISITOR_INFO1_LIVE=gr55qLcKQb4; expires=Sat, 28-Nov-2015 09:37:57 GMT; path=/; domain=.youtube.com; HttpOnly
< Alternate-Protocol: 443:quic,p=0.5
< Accept-Ranges: none
< Vary: Accept-Encoding
< Transfer-Encoding: chunked
<
{ [data not shown]
100  182k    0  182k    0     0  96317      0 --:--:--  0:00:01 --:--:-- 96327
* Connection #0 to host www.youtube.com left intact

youtube-dl https://www.youtube.com/watch\?v\=WBsyc139pvA -v
[debug] System config: []
[debug] User config: []
[debug] Command-line args: [u'https://www.youtube.com/watch?v=WBsyc139pvA', u'-v']
[debug] Encodings: locale UTF-8, fs utf-8, out UTF-8, pref UTF-8
[debug] youtube-dl version 2015.03.24
[debug] Python version 2.7.9 - Darwin-14.3.0-x86_64-i386-64bit
[debug] exe versions: ffmpeg 2.6.1, ffprobe 2.6.1
[debug] Proxy map: {}
[youtube] WBsyc139pvA: Downloading webpage
ERROR: Unable to download webpage: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)> (caused by URLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)'),))
  File "/usr/local/bin/youtube-dl/youtube_dl/extractor/common.py", line 314, in _request_webpage
    return self._downloader.urlopen(url_or_request)
  File "/usr/local/bin/youtube-dl/youtube_dl/YoutubeDL.py", line 1673, in urlopen
    return self._opener.open(req, timeout=self._socket_timeout)
  File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 431, in open
    response = self._open(req, data)
  File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 449, in _open
    '_open', req)
  File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 409, in _call_chain
    result = func(*args)
  File "/usr/local/bin/youtube-dl/youtube_dl/utils.py", line 695, in https_open
    req, **kwargs)
  File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 1197, in do_open
    raise URLError(err)

jaimeMF · 2015-03-29T22:12:29Z

If you install openssl with hombrew (it should probably be already installed by wget and python), what happens if you run export SSL_CERT_FILE=/usr/local/etc/openssl/cert.pem first?

shelbyKiraM · 2015-03-30T00:39:37Z

17:38:04 user@Daedalus.local Downloads export SSL_CERT_FILE=/usr/local/etc/openssl/cert.pem
17:38:18 user@Daedalus.local Downloads youtube-dl https://www.youtube.com/watch\?v\=WBsyc139pvA --verbose
[debug] System config: []
[debug] User config: []
[debug] Command-line args: [u'https://www.youtube.com/watch?v=WBsyc139pvA', u'--verbose']
[debug] Encodings: locale UTF-8, fs utf-8, out UTF-8, pref UTF-8
[debug] youtube-dl version 2015.03.24
[debug] Python version 2.7.9 - Darwin-14.3.0-x86_64-i386-64bit
[debug] exe versions: ffmpeg 2.6.1, ffprobe 2.6.1
[debug] Proxy map: {}
[youtube] WBsyc139pvA: Downloading webpage
ERROR: Unable to download webpage: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)> (caused by URLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)'),))
File "/usr/local/bin/youtube-dl/youtube_dl/extractor/common.py", line 314, in _request_webpage
return self._downloader.urlopen(url_or_request)
File "/usr/local/bin/youtube-dl/youtube_dl/YoutubeDL.py", line 1673, in urlopen
return self._opener.open(req, timeout=self._socket_timeout)
File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 431, in open
response = self._open(req, data)
File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 449, in _open
'_open', req)
File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 409, in _call_chain
result = func(_args)
File "/usr/local/bin/youtube-dl/youtube_dl/utils.py", line 695, in https_open
req, *_kwargs)
File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 1197, in do_open
raise URLError(err)

izzyleung · 2015-04-03T14:38:44Z

Can reproduce this on Mac OS X, latest version of System, and the latest version of youtube-dl.

$ youtube-dl https://www.youtube.com/watch\?v\=7NZ9X9A2efA -v
[debug] System config: []
[debug] User config: []
[debug] Command-line args: [u'https://www.youtube.com/watch?v=7NZ9X9A2efA', u'-v']
[debug] Encodings: locale UTF-8, fs utf-8, out UTF-8, pref UTF-8
[debug] youtube-dl version 2015.03.28
[debug] Python version 2.7.9 - Darwin-14.3.0-x86_64-i386-64bit
[debug] exe versions: none
[debug] Proxy map: {}
[youtube] 7NZ9X9A2efA: Downloading webpage
ERROR: Unable to download webpage: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)> (caused by URLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)'),))
  File "/usr/local/bin/youtube-dl/youtube_dl/extractor/common.py", line 314, in _request_webpage
    return self._downloader.urlopen(url_or_request)
  File "/usr/local/bin/youtube-dl/youtube_dl/YoutubeDL.py", line 1673, in urlopen
    return self._opener.open(req, timeout=self._socket_timeout)
  File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 431, in open
    response = self._open(req, data)
  File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 449, in _open
    '_open', req)
  File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 409, in _call_chain
    result = func(*args)
  File "/usr/local/bin/youtube-dl/youtube_dl/utils.py", line 695, in https_open
    req, **kwargs)
  File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 1197, in do_open
    raise URLError(err)

SSL_CERT_FILE environment variable already exported:

$ echo $SSL_CERT_FILE
/usr/local/etc/openssl/cert.pem

Can use --no-check-certificate to download the video, but wonder what is going wrong with the certs.

Thanks in advance for your reply.

izzyleung · 2015-04-04T18:29:41Z

Found a solution:

Manually install ca-cert, then export this cert as an environment variable

A script to install certs: https://gist.github.com/1stvamp/2158128

and then export SSL_CERT_FILE="/usr/share/curl/ca-bundle.crt" in your .bashrc

jaimeMF · 2015-04-04T21:04:29Z

@izzyleung note that on that the script ca-cert is downloaded over http, probably not the most secure option.

izzyleung · 2015-04-04T21:23:28Z

@jaimeMF Yep, thanks for mentioning that.

And, just wonder why I have to manually install the certs rather than just use the system default. :-(

izzyleung · 2015-04-18T22:15:42Z

@blacRose @jaimeMF

Found out the solution, I think it might be the problem of the certs installed by brew's openssl, they might be expired.

Just force uninstall openssl by brew remove openssl, then rm -rf /usr/local/etc/openssl.
Finally, reinstall openssl by brew install openssl, it will reinstall the certs for you, and now youtube-dl should work fine without --no-check-certificate and you don't have to export the environment variable.
Link to the solution: Homebrew/legacy-homebrew#38800

You guys can also add this solution to README of this project to remind those who have the certificate problem.

DomT4 · 2015-04-18T23:44:23Z

Problem and temporary workaround detailed below for via Homebrew installations. This isn't a solution, just a dirty hack until OpenSSL do something with the upstream bug report, or Apple do something with the cert situation.

Homebrew/legacy-homebrew#38800 (comment)
Homebrew/legacy-homebrew#38495
Homebrew/legacy-homebrew#38491

jaimeMF · 2015-04-19T09:40:44Z

Thanks for finding the "solution", I'm closing the issue. Feel free to submit a PR adding it to the FAQ

ghost · 2015-04-25T09:50:04Z

This solved the problem for me, thank you!

brew uninstall --force openssl
brew install openssl

DomT4 · 2015-04-25T17:20:27Z

You shouldn't need to force removal of the existing OpenSSL first - Just brew update && brew reinstall openssl.

slmingol · 2015-05-24T14:46:24Z

Just confirming that I had this problem and the solution to do this worked:

brew update && brew reinstall openssl

ghost · 2015-11-02T10:03:58Z

please help me remove the same error in Ubuntu. I have tried uninstalling openssl using apt-get.

Paddywhacker · 2015-12-18T09:05:26Z

Is this relevant for SSL Certificate failure in Win 7, using youtube-dl updated 18 Dec, and also using youtube-dl-GUI-0.3.7-win? The GUI always fails, the command line only sometimes.

yan12125 · 2015-12-18T10:13:49Z

Things are different on Windows and Unix-like systems. See #7309 for more information. Especially, @skarp7c1 provides a possible solution in #7309 (comment).

starrychloe · 2016-01-14T06:49:41Z

How do you fix this in Windows and Chocolatey? I already have

SSL_CERT_FILE=C:\ruby200\cacert.pem

Which I got from http://curl.haxx.se/ca/cacert.pem

yan12125 · 2016-01-14T06:54:30Z

If I got it right Chocolatey uses official Windows installers from python.org, so you need to do the same - delete expired CA certificates.

starrychloe · 2016-01-14T08:45:44Z

What do you mean "delete expired CA certificates"? It's just a text file. Which certificate? They are all encoded. I don't feel like decoding every one to find it's expiration date. I don't even have openssl installed in Windows.

yan12125 · 2016-01-14T08:59:22Z

See #7309 for detailed steps. Note that @skarp7c1's approach (install Google's new certificate) is incorrect. You should remove invalid certificates instead of add new ones.

pjobson · 2017-09-14T01:22:09Z

This can also happen if you have something set as your LD_LIBRARY_PATH.

For example exporting plex's lib path...

export LD_LIBRARY_PATH=/usr/lib/plexmediaserver:$LD_LIBRARY_PATH

Causes similar errors. Sorry to bounce up an old bug, couldn't find a useful place to put this as it may be helpful for someone else.

yan12125 · 2018-07-06T19:28:26Z

@outhud: remove the broken OpenSSL installation in /usr/local (1.1.1-dev) and rebuild Python if necessary

marek-knappe · 2018-09-24T03:31:44Z

Found a solution:

Manually install ca-cert, then export this cert as an environment variable

A script to install certs: https://gist.github.com/1stvamp/2158128

and then export SSL_CERT_FILE="/usr/share/curl/ca-bundle.crt" in your .bashrc

Worked for me.

eaglepie · 2019-08-19T06:52:44Z

Found a solution:

Manually install ca-cert, then export this cert as an environment variable

A script to install certs: https://gist.github.com/1stvamp/2158128

and then export SSL_CERT_FILE="/usr/share/curl/ca-bundle.crt" in your .bashrc

I used this method , and it's worked!

yan12125 mentioned this issue Apr 10, 2015

SSL: CERTIFICATE_VERIFY_FAILED on OS X 10.10.3 #5393

Closed

dstftw mentioned this issue Apr 14, 2015

SSL certificate validation failure #5427

Closed

izzyleung mentioned this issue Apr 18, 2015

wget installed by brew cannot verify Google certs Homebrew/legacy-homebrew#38800

Closed

jaimeMF closed this Apr 19, 2015

This was referenced May 4, 2015

SSL: CERTIFICATE_VERIFY_FAILED - Mac, python 2 and 3 #5605

Closed

ERROR: Unable to download video webpage: <urlopen _FAILED] certificate verify failed (_ssl.c:547)> #883

Closed

SSL: CERTIFICATE_VERIFY_FAILED Error #5668

Closed

ids1024 mentioned this issue May 15, 2015

"Found nothing for" every search mps-youtube/mps-youtube#265

Closed

jaimeMF mentioned this issue Jun 17, 2015

Youtube - ssl: certificate_verify_failed #4896

Closed

Pysis868 mentioned this issue Nov 30, 2015

ERROR: Unable to download webpage: <urlopen error [Errno 64] Host is down> (caused by URLError(error(64, 'Host is down'),)) #7707

Closed

yan12125 mentioned this issue Feb 29, 2016

I'm Facing this Issue: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)') #8697

Closed

yan12125 mentioned this issue Mar 18, 2016

iOS Application use youtube-dl #8879

Closed

yan12125 mentioned this issue Apr 1, 2016

0S X 10.4 and SSL certificate #9040

Closed

0 of 7 tasks complete

ritiek mentioned this issue Jun 12, 2017

`--no-check-certificate` option in pafy ? mps-youtube/pafy#148

Open

yan12125 mentioned this issue Sep 23, 2017

SSL certificate_verify_failed #14300

Closed

5 of 8 tasks complete

baffled-mart mentioned this issue Jul 12, 2019

ITV (UK) SSL: CERTIFICATE_VERIFY_FAILED #21754

Closed

abhiTronix mentioned this issue Jan 20, 2020

SSL: CERTIFICATE_VERIFY_FAILED with YouTube Mode in CamGear on macOS abhiTronix/vidgear#100

Closed

5 of 5 tasks complete

ytdl-org / youtube-dl

SSL: CERTIFICATE_VERIFY_FAILED? #5317

SSL: CERTIFICATE_VERIFY_FAILED? #5317

shelbyKiraM commented Mar 29, 2015

yan12125 commented Mar 29, 2015

shelbyKiraM commented Mar 29, 2015

jaimeMF commented Mar 29, 2015

shelbyKiraM commented Mar 29, 2015

jaimeMF commented Mar 29, 2015

shelbyKiraM commented Mar 30, 2015

izzyleung commented Apr 3, 2015

izzyleung commented Apr 4, 2015

jaimeMF commented Apr 4, 2015

izzyleung commented Apr 4, 2015

izzyleung commented Apr 18, 2015

DomT4 commented Apr 18, 2015

jaimeMF commented Apr 19, 2015

ghost commented Apr 25, 2015

DomT4 commented Apr 25, 2015

slmingol commented May 24, 2015

ghost commented Nov 2, 2015

Paddywhacker commented Dec 18, 2015

yan12125 commented Dec 18, 2015

starrychloe commented Jan 14, 2016

yan12125 commented Jan 14, 2016

starrychloe commented Jan 14, 2016

yan12125 commented Jan 14, 2016

pjobson commented Sep 14, 2017

yan12125 commented Jul 6, 2018

marek-knappe commented Sep 24, 2018

eaglepie commented Aug 19, 2019 •

edited

ytdl-org / youtube-dl

Join GitHub today

GitHub is where the world builds software

SSL: CERTIFICATE_VERIFY_FAILED? #5317

SSL: CERTIFICATE_VERIFY_FAILED? #5317

Comments

shelbyKiraM commented Mar 29, 2015

yan12125 commented Mar 29, 2015

shelbyKiraM commented Mar 29, 2015

jaimeMF commented Mar 29, 2015

shelbyKiraM commented Mar 29, 2015

jaimeMF commented Mar 29, 2015

shelbyKiraM commented Mar 30, 2015

izzyleung commented Apr 3, 2015

izzyleung commented Apr 4, 2015

jaimeMF commented Apr 4, 2015

izzyleung commented Apr 4, 2015

izzyleung commented Apr 18, 2015

DomT4 commented Apr 18, 2015

jaimeMF commented Apr 19, 2015

ghost commented Apr 25, 2015

DomT4 commented Apr 25, 2015

slmingol commented May 24, 2015

ghost commented Nov 2, 2015

Paddywhacker commented Dec 18, 2015

yan12125 commented Dec 18, 2015

starrychloe commented Jan 14, 2016

yan12125 commented Jan 14, 2016

starrychloe commented Jan 14, 2016

yan12125 commented Jan 14, 2016

pjobson commented Sep 14, 2017

yan12125 commented Jul 6, 2018

marek-knappe commented Sep 24, 2018

eaglepie commented Aug 19, 2019 • edited

Essential cookies

Always active

Analytics cookies

eaglepie commented Aug 19, 2019 •

edited