Develop Reference

I receive SSL CERTIFICATE_VERIFY_FAILED when doing poetry install

I am trying to create a virtual environment and I was able to do in the past with poetry install. But now when trying to do a poetry install, I receive this message:
Max retries exceeded with url: /pypi/six/1.16.0/json (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)')))
at ~/.poetry/lib/poetry/_vendor/py3.9/requests/adapters.py:514 in send
510│ raise ProxyError(e, request=request)
511│
512│ if isinstance(e.reason, _SSLError):
513│ # This branch is for urllib3 v1.22 and later.
→ 514│ raise SSLError(e, request=request)
515│
516│ raise ConnectionError(e, request=request)
517│
518│ except ClosedPoolError as e:

what worked for me (MacOS)
go to Applications > Python folder > double click on "Install Certificates.command" file

It seems like Python's requests library cannot find your certificates.
Have you configured a custom repository with a self-signed certificate?
If so I have not found a great solution to this problem.
In that case, please see whether you have set your CURL_CA_BUNDLE environment variable:
$ echo $CURL_CA_BUNDLE
If this points to some custom location/self-signed certificate, requests is not able to use its standard certificate bundle.
You can unset it(might have side effects on services that uses it):
export CURL_CA_BUNDLE=""
If you have not configured any custom repository/certificates:
You might be able to solve this by installing certifi

Python 3.7 when installed on MacOSX systems needs to run a script to install certificate dependencies on your system for python environment via bash.
#!/bin/sh
/Library/Frameworks/Python.framework/Versions/3.7/bin/python3.7 << "EOF"
# install_certifi.py
#
# sample script to install or update a set of default Root Certificates
# for the ssl module. Uses the certificates provided by the certifi package:
# https://pypi.org/project/certifi/
import os
import os.path
import ssl
import stat
import subprocess
import sys
STAT_0o775 = ( stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR
| stat.S_IRGRP | stat.S_IWGRP | stat.S_IXGRP
| stat.S_IROTH | stat.S_IXOTH )
def main():
openssl_dir, openssl_cafile = os.path.split(
ssl.get_default_verify_paths().openssl_cafile)
print(" -- pip install --upgrade certifi")
subprocess.check_call([sys.executable,
"-E", "-s", "-m", "pip", "install", "--upgrade", "certifi"])
import certifi
# change working directory to the default SSL directory
os.chdir(openssl_dir)
relpath_to_certifi_cafile = os.path.relpath(certifi.where())
print(" -- removing any existing file or link")
try:
os.remove(openssl_cafile)
except FileNotFoundError:
pass
print(" -- creating symlink to certifi certificate bundle")
os.symlink(relpath_to_certifi_cafile, openssl_cafile)
print(" -- setting permissions")
os.chmod(openssl_cafile, STAT_0o775)
print(" -- update complete")
if __name__ == '__main__':
main()
EOF
This is the contents of the bash script which installs certifi package ssl certs. It should also be located in your installed Python folder in Applications.
cd /Applications/Python\ 3.7/
./Install\ Certificates.command

Ansible: Setup webtatic yum source for php-fpm failed

I'm trying to Setup webtatic yum source for php-fpm in ansible playbook.
My code is:
- name: Setup webtatic yum source for php-fpm
yum: name=https://mirror.webtatic.com/yum/el7/webtatic-release.rpm
It fails with the error:
fatal: [test.example.com]: FAILED! => {"changed": false, "msg": "**Failed to validate the SSL certificate for mirror.webtatic.com:443. Make sure your managed systems have a valid CA certificate installed. You can use validate_certs=False if you do not need to confirm the servers identity but this is unsafe and not recommended.** Paths checked for this platform: /etc/ssl/certs, /etc/pki/ca-trust/extracted/pem, /etc/pki/tls/certs, /usr/share/ca-certificates/cacert.org, /etc/ansible. The exception msg was: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618)."}
How can I write it correctly?

This tends to happen when your managed node does not have the CA root certificate bundle installed.
A possible fix would be to verify it is present before trying to install your rpm:
- name: Setup webtatic yum source for php-fpm
yum:
name: "{{ packages }}"
vars:
packages:
- ca-certificates # This package contains the required CA root certificate bundle
- https://mirror.webtatic.com/yum/el7/webtatic-release.rpm

The problem root might be in your local time if it is not synchronized correctly.
I assume that you have ca-certificates package already installed.
The CA certificate issues are sometimes related to the incorrect time.
openssl s_client -host mirror.webtatic.com -port 443 \
-CAfile /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
Look for Verify return code: 9 (certificate is not yet valid) or notBefore=...
Please, try to install the ntp and ntpdate packages, then synchronize your time. There is an example for CentOS how to do it: https://thebackroomtech.com/2019/01/17/configure-centos-to-sync-with-ntp-time-servers/
This should fix your problem if it was due to unsynchronized time.

conda : SSLError(SSLError(SSLError("bad handshake: SysCallError(104, 'ECONNRESET')",),),) conda

I want to use miniconda3 to install a package but it pops that error:
Solving environment: failed
CondaHTTPError: HTTP 000 CONNECTION FAILED for url <https://repo.anaconda.com/pkgs/main/noarch/repodata.json.bz2>
Elapsed: -
An HTTP error occurred when trying to retrieve this URL. HTTP errors are often intermittent, and a simple retry will get you on your way.
If your current network has https://www.anaconda.com blocked, please file a support request with your network engineering team.
SSLError(SSLError(SSLError("bad handshake: SysCallError(104, 'ECONNRESET')",),),)
BTW, the miniconda2 runs wells only miniconda3 has the problem.
PS. I also tried to use wget --no-check-certificate to download the file and got the error too:
wget https://repo.anaconda.com/pkgs/main/linux-64/repodata.json.bz2
--2019-03-14 02:03:44-- https://repo.anaconda.com/pkgs/main/linux-64/repodata.json.bz2
Resolving repo.anaconda.com (repo.anaconda.com)... 104.16.130.3,
104.16.131.3, 2606:4700::6810:8303, ...
Connecting to repo.anaconda.com (repo.anaconda.com)|104.16.130.3|:443... connected.
Unable to establish SSL connection.
The system is CentOS and I have already use sudo yum update to update the sys file and library.

Inserting data into mongoDB using pymongo

i seem to be unable to upload data into my mongo db hosted on atlas. I have copied the exact steps posted here. https://www.w3schools.com/python/python_mongodb_insert.asp
import pymongo
import requests
url= "mongodb://jordan:*********#jordandb-shard-00-00-ykcna.mongodb.net:27017,jordandb-shard-00-01-ykcna.mongodb.net:27017,jordandb-shard-00-02-ykcna.mongodb.net:27017/test?ssl=true&replicaSet=JordanDB-shard-0&authSource=admin&retryWrites=true"
client = pymongo.MongoClient(url)
mydb = client.test
mycol = mydb["customers"]
mydict = {"name":"John", "adress":"Highway 37"}
x = mycol.insert_one(mydict)
print(client.list_database_names())
I am receiving a timeout error. Every line works until i get to the insert line (x = ....). I am using pycharm and python 3.7. However I have also tried this on jupyter and have received the same error:
pymongo.errors.ServerSelectionTimeoutError: jordandb-shard-00-00-ykcna.mongodb.net:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1056),jordandb-shard-00-01-ykcna.mongodb.net:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1056),jordandb-shard-00-02-ykcna.mongodb.net:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1056)
Here are the steps I am following to get the url

There's a couple of reasons for this.
The most obvious one would be that you're missing the certificate chain.
You can get the chain information from issuing:
openssl s_client -showcerts -servername jordandb-shard-00-00-ykcna.mongodb.net -connect jordandb-shard-00-00-ykcna.mongodb.net:27017 </dev/null
Which will tell you that it's from DigiCert. So either you're missing that certificate chain in your local certificate store (some distro's might need you to install a root ca trust). But if you do have root ca's installed. It's time to check the validation times on the cert.
If you add | openssl x509 -noout -dates you'll get the valid dates for this certificate:
openssl s_client -showcerts -servername jordandb-shard-00-00-ykcna.mongodb.net -connect jordandb-shard-00-00-ykcna.mongodb.net:27017 </dev/null | openssl x509 -noout -dates
Which tells you the certificate is from DigiCert.
And the certificate is valid from 7/02-19 00:00 GMT to 11/2-19 12:00 GMT.
Running date in any terminal should hopefully tell you that you're in between these two dates.
In any other case, I would say this is due to a self signed certificate.
In which case you would need to do one of two things:
MongoClient(..., ssl_ca_certs='/path/to/ca.pem')
MongoClient(..., ssl_cert_reqs=ssl.CERT_NONE)
To either supply your custom CA or tell Mongo to ignore certificate validation (the later being the worst possible option. Even if you say "I won't forget to fix that later", heh).

You Can Use pymongo default function
connObj = MongoClient(MONGO_HOST, MONGO_PORT)
connObj[MONGO_DB].authenticate(MONGO_UNAME, MONGO_PASSWD)

When I use python boto connect to aws ec2 , it show SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661)

I'm using Windows 10 OS.
I want to count the number of IP Address of AWS.
I use python 2.7.14 and boto 2.6.0
I add a file which name is boto.config locate C:\Users\Administrator folder
The content of the boto.config is:
[Credentials]
aws_access_key_id=******
aws_secret_access_key=*****
The script is :
#!/usr/bin/env python
# -*- encoding: utf8 -*-
import boto.ec2
from pprint import pprint
import ssh
import requests
import urllib3
import certifi
import ssl
conn = boto.ec2.connect_to_region('cn-north-1')
reservations = conn.get_all_instances()
InstanceMap=[]
for reservation in reservations:
for instance in reservation.instances:
if 'env' in instance.tags and instance.tags['env'] == 'test':
InstanceMap.append(instance.ip_address)
f = open('F:\ip.txt','w')
pprint(InstanceMap, f)
When I run this script, it show the error formation:
SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661)
What's the method can I solve this problem ?

I was having same issue with boto3 and Python 3.7 on Windows 10 machine. As it turned out, since I was using corporate device with Proxy installed, *.amazonaws.com certificate was getting replaced by the Proxy certificate. This Proxy certificate chain needed to be trusted by Python certifi module. Whether or not, you have a proxy, below method should resolve SSL: CERTIFICATE_VERIFY_FAILED error.
Here is what I did, to resolve the issue -
Find the path where cacert.pem is located -
Install certifi, if you don't have. Command: pip install certifi
import certifi
certifi.where()
C:\\Users\\[UserID]\\AppData\\Local\\Programs\\Python\\Python37-32\\lib\\site-packages\\certifi\\cacert.pem
Set AWS_CA_BUNDLE environment variable to the cacert.pem path -
AWS_CA_BUNDLE=C:\Users\[UserID]\AppData\Local\Programs\Python\Python37-32\Lib\site-packages\certifi\cacert.pem
Download the chain of certificates from amazonaws.com URL. For example: Go to https://sts.amazonaws.com/xyz on a browser and export Root, all the intermediate certificates, domain cert and save as base64 encoded .cer file. Open the certificates in notepad, copy all the contents.
Now open the cacert.pem in a notepad and just add every downloaded certificate contents (---Begin Certificate--- *** ---End Certificate---) at the end.
Restart the command line prompt or PowerShell, SSL verification error should be resolved.
Do not use is_secure = False in your organization's envrionments. This is essentially disabling SSL verification.

Try adding is_secure = False like below, in order to skip ssl verification,
conn = boto.ec2.connect_to_region('cn-north-1',is_secure=False)
Try providing the credentials as so, that way you would know if the keys in boto config are old if this works, and if this returns the same issue then you need to check your api-key and secret on aws.
API_KEY = 'Actual API_KEY'
API_SECRET = 'Actual Secret'
conn = boto.ec2.connect_to_region('us-east-2',aws_access_key_id=API_KEY,aws_secret_access_key=API_SECRET,is_secure=False)