Cibuildwheel: Windows: urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed

[rmk135]

Hello,

Can you, please, help me to debug https://travis-ci.org/github/ets-labs/python-dependency-injector/jobs/739050288?

It occurs only on Windows. Error says: urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1108)>. I'm unclear whos certificate has expired.

Best,
Roman

[Czaki]

Please bump cibuildwheel to the most recent version. it should be fixed in #447

[rmk135]

Got it, will try. Thank you.

[jcrist]

I'm currently seeing this as well on travis ci windows builds only, already running the latest version (1.6.3). I did a release yesterday and things worked fine, so somethings changed in the last day (likely the certs on the windows box).

I've worked around this by installing certifi and configuring the build to use certifi's certs, see here:

https://github.com/jcrist/quickle/pull/58/files#diff-6ac3f79fc25d95cd1e3d51da53a4b21b939437392578a35ae8cd6d5366ca5485R31

[rmk135]

@jcrist , cool, thanks for sharing.

[Czaki]

oh. So it is outdated certif on this python
Could you try to bump python version in travis file from 3.8.0 to 3.8.2

        - choco install python --version 3.8.2

@jcrist @rmk135?

[jcrist]

I'm already using 3.8.6 (in that PR), which didn't fix things. Installing certifi and forcing the build to use certifi certs did fix things.

[Czaki]

starnge

[rmk135]

@jcrist , did you face such issue on windows The command "python3 -m pip install certifi cibuildwheel==1.6.3" failed and exited with 127 during .?

The reason looks strange:

Your build has been stopped. 
/c/Users/travis/.travis/functions: line 109: python3: command not found

https://travis-ci.com/github/ets-labs/python-dependency-injector/jobs/411227719

I have it after tried your solution.

PS: I have recently migrated from travis-ci.org to travis-ci.com.

[rmk135]

Fixed python3: command not found by adding a line from README into before_install:

      - ln -s /c/Python38/python.exe /c/Python38/python3.exe

Seems that wasn't needed when I initially configured windows builds.

[rmk135]

Thanks everybody for the help and special thanks to this lib creators and contributors for the great tool.

[joerick]

I just spotted this in an unrelated PR, this time on Appveyor:

https://ci.appveyor.com/project/joerick/cibuildwheel/builds/36032538/job/n4duoutlja3nbqit

It's happening in the host process, not in a version of Python installed by cibuildwheel. But still on that initial nuget download.

[jcrist]

Perhaps cibuildwheel should require certifi as a dependency and explicitly use certifi's certs in e.g. download instead of relying on the system certs? requests does this, and it seems to work well: https://requests.readthedocs.io/en/master/user/advanced/#ca-certificates.

[Czaki]

It looks rather like outdated windows images from CI provider. There is possibility to change certificate source after scripts run?

[mayeut]

I got the same issue on one of my projects on Appveyor...
I proposed a PR based on @jcrist comment. It seems like a good solution (if it works, but I don't doubt it will. Let's wait for PR CI status).

[joerick]

This is fixed in v1.6.4.

[henryiii]

@joerick no GitHub release?

[joerick]

@henryiii oops, thanks for the reminder!