Page History

...

WARNING: httplib2.URLError received None <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed

Solution

The problem may be that the SSL library used in this Python version doesn't look in the correct certificate path.

• Try from another environment.
• Check which version of Python you are using and how it was installed and linked to openssl.
• Check that ca-certificates are updated on your system. Important, the client, openssl on most systems, maintains a set of trusted root CAs that are used to validate the chain (intermediate cert > server cert) on a ssl connection, so they must be updated on the client.
  • Update OpenSSL, ca-certificates and Python.
  • The following are some references on how to update the ca-certificates package:

...

• • In case you need to add a specific Root Certificate, run the following command (The browser can be used to get the same information, if not on a *nix system, on view certificate):

user@local:~> openssl s_client -connect api.ecmwf.int:443                                                                                 
CONNECTED(00000003)
depth=2 C = BM, O = QuoVadis Limited, CN = QuoVadis Root CA 2 G3
...

Here we can see QuoVadis Root CA 2 G3 is the Root CA for api.ecmwf.int and can be downloaded from https://www.quovadisglobal.com/QVRepository/DownloadRootsAndCRL.aspx and installed locally (as per the commands specified above on the specific OS).

If you have the SSL error in the last step of your request (Transferring from...), you need to install the Root CA for "stream.ecmwf.int": QuoVadis Global SSL ICA G2

• The following is an hack for cases when updates are not possible for whatever reason:

  • Disable SSL Verification, this can be achieved by setting CURL_CA_BUNDLE="" before calling the python api:
    • CURL_CA_BUNDLE="" python main.py

• • Specify the Root CA directly, this can be achieved by setting REQUESTS_CA_BUNDLE="path to ROOT ca QuoVadis Root CA 2 G3" downloaded from the Quovadis Website (that your system cannot find somehow):
    • REQUESTS_CA_BUNDLE="/path_to_cert/QuoVadis_Root_CA_2_G3.pem" python main.py

Related articles

...