CERTIFICATE_VERIFY_FAILED on CPython 2.7 on macOS

[un-def]

On CPython 2.7 on macOS, I sometimes get the following error from urllib2.urlopen:

[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:727)

I noticed that the error is present when the runner uses a cached build of CPython. When the runner builds CPython from source, the error is not present. It's just a guess, but may be the runner doesn't cache the certificates?

Failed builds:

• https://github.com/un-def/hererocks/actions/runs/8742014557/job/24010209557
• https://github.com/luarocks/hererocks/actions/runs/8741397246/job/23987459699

All have the following in the log:

Trying to use cached built version
  Restoring cached version with key CPython2.7.18x64darwin...
  Cache Size: ~25 MB (25972007 B)
  /usr/local/bin/gtar -xf /Users/runner/work/_temp/6e400571-a12c-479e-954c-753e8d58efd7/cache.tzst -P -C /Users/runner/work/hererocks/hererocks --delay-directory-restore --use-compress-program unzstd
  Received 25972007 of 25972007 (100.0%), 24.8 MBs/sec
  Cache restored successfully
  CPython 2.7.18 restored from cache.

Successful builds:

All have the followin in the log:

Trying to use cached built version
  Restoring cached version with key CPython2.7.18x64darwin...
  Cached version not found.
Installing dependencies
Preparing sources
Applying patches to source files
Configuring makefile
Running make
Running make install
Caching built files

• https://github.com/un-def/hererocks/actions/runs/8720665041/job/23922706900
• https://github.com/luarocks/hererocks/actions/runs/8741708210/job/23988474047
• https://github.com/luarocks/hererocks/actions/runs/8720429513/job/23921920354
• https://github.com/un-def/hererocks/actions/runs/8718281585/job/23915184309

[MatteoH2O1999]

I honestly do not think this is on this action, as the fact you can even use pip install STUFF means the certificates are in place and urllib recognizes them. Maybe you depend on having certificates in a certain path?

[un-def]

the fact you can even use pip install STUFF means the certificates are in place

pip doesn't use system certificates, it comes with bundled certifi.

By default, pip will perform SSL certificate verification for network connections it makes over HTTPS. These serve to prevent man-in-the-middle attacks against package downloads. This does not use the system certificate store but, instead, uses a bundled CA certificate store from certifi. [emphasis added]

https://pip.pypa.io/en/stable/topics/https-certificates/

[un-def]

I created a repository to debug the issue: https://github.com/un-def/setup-python-27-macos-test

Job with freshly built Python

https://github.com/un-def/setup-python-27-macos-test/actions/runs/8757133642/job/24035135738

cafile = /usr/local/etc/openssl/cert.pem — exists
capath = /usr/local/etc/openssl/certs — exists, empty directory
urlopen() — OK

Job with cached Python build

https://github.com/un-def/setup-python-27-macos-test/actions/runs/8757292724/job/24035619901

cafile = /usr/local/etc/openssl/cert.pem — doesn't exist
capath = /usr/local/etc/openssl/certs — doesn't exist
urlopen — URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:727)>

---

If I understand correctly, cert.pem is generated when OpenSSL is installed.

https://github.com/rbenv/homebrew-tap/blob/e472b7861b49cc082d1db0f66f265368da107589/Formula/openssl%401.0.rb#L45-L66

From the log:

A CA file has been bootstrapped using certificates from the SystemRoots keychain.

Since OpenSSL is not installed when a cached Python build is used, we don't have a certificate bundle in such jobs.

[un-def]

One possible solution is to add a post-install step which installs certificates. Since Python 3.6 there is a script for this task, it installs certifi and symlinks cert.pem from it to a system location: https://github.com/python/cpython/blob/v3.12.3/Mac/BuildScript/resources/install_certificates.command

From ReadMe.rtf:

Certificate verification and OpenSSL

This package includes its own private copy of OpenSSL 3.0.      The trust certificates in system and user keychains managed by the Keychain Access application and the security command line utility are not used as defaults by the Python ssl module.    A sample command script is included in /Applications/Python 3.12 to install a curated bundle of default root certificates from the third-party certifi package (https://pypi.org/project/certifi/).    Double-click on Install Certificates to run it.

[MatteoH2O1999]

It should be fixed now with v3.2.1.
Feel free to reopen if the issue persists