15

Goal: I'm on RedHat 5 and trying to install the latest python and django for a web app.

I successfully altinstalled python27 and easy_install, and wget with openssl.

Problem: However now that I try to get anything from pypi.python.org I get the following error: 

$ sudo easy_install --verbose django
Searching for django
Reading https://pypi.python.org/simple/django/
Download error on https://pypi.python.org/simple/django/: [Errno 1] _ssl.c:507: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed -- Some packages may not be found!
Couldn't find index page for 'django' (maybe misspelled?)
Scanning index of all packages (this may take a while)
Reading https://pypi.python.org/simple/
Download error on https://pypi.python.org/simple/: [Errno 1] _ssl.c:507: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed -- Some packages may not be found!
No local packages or download links found for django
error: Could not find suitable distribution for Requirement.parse('django')

I tried looking up the certificate of pypi.python.org with openssl s_client -showcert -connect but don't know what to do with it, where to store it. Not much info on google, need expert help.

Thank you!

edit: I meant wget* with openssl. 

$ wget http://ftp.gnu.org/gnu/wget/wget-1.15.tar.gz
$ tar -xzf wget-1.15.tar.gz
$ cd wget-1.15
$ ./configure --with-ssl=openssl
$ make
$ sudo make install

I can't get wget to pull the page either: 

$ wget https://pypi.python.org/simple/django/
--2014-01-21 11:18:45--  https://pypi.python.org/simple/django/
Resolving pypi.python.org (pypi.python.org)... 199.27.73.185, 199.27.74.184
Connecting to pypi.python.org (pypi.python.org)|199.27.73.185|:443... connected.
ERROR: cannot verify pypi.python.org's certificate, issued by ‘/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance CA-3’:
  Unable to locally verify the issuer's authority.
To connect to pypi.python.org insecurely, use `--no-check-certificate'.
dlite922
  • 1,786
  • 3
  • 20
  • 53
  • 6
    Run this command, it seems your CA certs are not updated: `curl http://curl.haxx.se/ca/cacert.pem -o /etc/pki/tls/certs/ca-bundle.crt` and then try again. – Burhan Khalid Mar 18 '14 at 07:09
  • @BurhanKhalid Spot on.. thanks for that. You should submit that as an answer, its likely everyone's struggle... – Luke Chavers Dec 19 '14 at 12:49

4 Answers4

16

your curl cert is too old try to download new curl cert:

sudo wget http://curl.haxx.se/ca/cacert.pem -O /etc/pki/tls/certs/ca-bundle.crt
Neil
  • 20,635
  • 14
  • 48
  • 68
eleforest
  • 332
  • 2
  • 6
  • 4
    It's worth noting that, per one of the other posts, the `/etc/pki/tls/certs` directory need not exist beforehand as it's a hard coded location that will be searched by setuptools. – Kaleb Pederson Dec 17 '15 at 05:20
  • 1
    Do `mkdir -p /etc/pki/tls/certs` first if `/etc/pki/tls/certs` does not exist. – Helin Wang Jan 19 '18 at 19:51
9

I found this page after looking for a solution to this problem. In case someone else has similar problem, the solution I found is:

At the start of the setuptools/ssl_support.py file (which is used by easy_install, and is inside the egg file: ./lib/python2.7/site-packages/setuptools-3.5.1-py2.7.egg), the certificate bundles files are hard-coded in cert_paths variable:

cert_paths = """
/etc/pki/tls/certs/ca-bundle.crt
/etc/ssl/certs/ca-certificates.crt
/usr/share/ssl/certs/ca-bundle.crt
/usr/local/share/certs/ca-root.crt
...etc..
"""

easy_install will use the first file that exists from this list, as it calls find_ca_bundle. If certificates in this cert bundle file are out of date, then easy_install will fail with this SSL error. So need to either update the certificate file or change the cert_paths in this ssl_support.py file, to point to a local up-to-date certs bundle file.

phoenix
  • 3,988
  • 1
  • 29
  • 33
Stephen Bridgett
  • 501
  • 7
  • 7
  • 1
    [Still exists in the `setuptools` code base in 2020](https://github.com/pypa/setuptools/blob/dabd73137f97145cc95c114937c95b217ac76876/setuptools/ssl_support.py#L21-L30) – phoenix May 20 '20 at 16:35
2

I have seen this problem in a specific environment: Mac OS X with macports, installing packages in user's local path. The solution was to install the certificates from curl:

port install curl-ca-bundle

Btw, until you don't have the ceritificates, most of the port, easy_install and pip commands will fail because the ssl error.

deeenes
  • 3,334
  • 4
  • 33
  • 50
-3

Try installing pip to do python package installation instead.

You can find the documentation to quick install it and use it here. It's generally a lot better than easy_install.

It also uses SSL by default, and with Requests' certificate stack (derived from mozilla).

You can also find a lot of information on working with python packages in general on the Python Packaging User Guide.

Ivo
  • 5,332
  • 2
  • 15
  • 18
  • 6
    This is circular advice. The pip sites directs me to install ez_setup.py which is easy_install. I need to solve this certificate error. It seems to plague more than just this. – dlite922 Jan 21 '14 at 18:23
  • 3
    Hi there, the `get-pip.py` bootstrap file should no longer require `ez_setup.py` :) It will install both `pip` and `setuptools` for you. The specific reason I suggest pip is that it should come with its own CA cert stack for verifying the connection. – Ivo Jan 24 '14 at 10:41
  • i can download get-pip.py with no-check-certificate, but once I run it, it gives me certificate errors trying to install setuptools and pip. – dlite922 Jan 28 '14 at 20:08
  • I'm now thinking that the reason that `wget` can't securely connect to pypi would also be the reason anything else (like `pip` and `easy_install`) cannot either. Certainly PyPI's Cert works just fine for many many other devices I use over SSL/TLS. Have you tried with a latest build of OpenSSL? I suspect RedHat 5's would be getting quite old. – Ivo Jan 29 '14 at 13:41
  • Yeah maybe old openssl, I moved hosts to a debian wheezy and everything installed perfectly the first time. Debain 1, RedHat 0 – dlite922 Jan 29 '14 at 17:22
  • @Ivo, this worked for me. All of my wget statements needed a --no-check-certificate in order to work, but subsequent pip install commands on packages that are behind https worked fine. – shadanan Mar 17 '14 at 20:12
  • There are some situations were you must use easy_install. pip is great, but it's not the solution to this problem. – Anthony Roberts Feb 18 '19 at 20:53