Unable to locate SSL certificates
CIAO ships with a copy of the openSSL library. This is required to provide access to any encrypted website, ie https://. The library makes use of signed certificates on the users machine; however, the location of that certificate file is OS dependent -- different Linux distributions install the file in different locations.
Some users trying to access an encrypted URL may see an error message like
% python -c 'from urllib import request; request.urlopen("https://cxc.cfa.harvard.edu/ciao/");' Traceback (most recent call last): File "/home/user/ciao-4.13/ots/lib/python3.7/urllib/request.py", line 1254, in do_open h.request(req.get_method(), req.selector, req.data, headers) File "/home/user/ciao-4.13/ots/lib/python3.7/http/client.py", line 1107, in request self._send_request(method, url, body, headers) File "/home/user/ciao-4.13/ots/lib/python3.7/http/client.py", line 1152, in _send_request self.endheaders(body) ... File "/home/user/ciao-4.13/ots/lib/python3.7/ssl.py", line 641, in do_handshake self._sslobj.do_handshake() ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:719) ...
Users can try setting the environment variables: SSL_CERT_FILE and|or SSL_CERT_DIR. These should point to the location of the cert.pm file on the system
bash$ export SSL_CERT_FILE=/etc/ssl/cert.pem bash$ export SSL_CERT_DIR=/etc/ssl/certs or tcsh% setenv SSL_CERT_FILE /etc/ssl/cert.pem tcsh% setenv SSL_CERT_DIR /etc/ssl/certs
If you are unsure where the certificate file is located then open a new terminal and try the following command.
$ python -c "import ssl; print(ssl.get_default_verify_paths())" DefaultVerifyPaths(cafile=None, capath=None, openssl_cafile_env='SSL_CERT_FILE', openssl_cafile='/etc/pki/tls/cert.pem', openssl_capath_env='SSL_CERT_DIR', openssl_capath='/etc/pki/tls/certs')
The SSL_CERT_FILE is the openssl_cafile_env and SSL_CERT_DIR is the openssl_capath_env.