Emscripten: Unable to install latest due to SSL certificate verify failed

[limitlessloop]

I'm getting the following error when I try to install using

./emsdk install latest   

Error downloading URL 'https://s3.amazonaws.com/mozilla-games/emscripten/packages/llvm/tag/osx_32bit/index.txt': <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1056)>

Error downloading URL 'https://s3.amazonaws.com/mozilla-games/emscripten/packages/llvm/tag/osx_64bit/index.txt': <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1056)>

Error downloading URL 'https://storage.googleapis.com/webassembly/emscripten-releases-builds/mac/f42b12c45fd3f4c20de1321402fbc28f8fd21df1/wasm-binaries.tbz2': <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1056)>

Is there a quick workaround for this?

[kripken]

Using a newer python, or using python3 (which is usually newer) should help.

There are some issue reports on the emsdk repo which might also help, https://github.com/emscripten-core/emsdk/search?q=CERTIFICATE_VERIFY_FAILED&type=Issues

[limitlessloop]

Thanks for the suggestions. :)

[EtherDream]

$ python --version
Python 3.7.4


$ ./emsdk install latest
Fetching emscripten-releases repository...
Repository 'https://chromium.googlesource.com/emscripten-releases' already cloned to directory '/Users/xxx/tool/emsdk/releases', skipping.
Fetching latest changes to the branch 'master' for '/Users/xxx/tool/emsdk/releases'...
Already up to date.
Successfully updated and checked out branch 'master' on repository '/Users/xxx/tool/emsdk/releases'
Current repository version: "Mon, 19 Aug 2019 05:36:07 +0000 4026f39abdc822ae19b34838439dc793edc37c31"
Fetching all precompiled tagged releases..
Error downloading URL 'https://s3.amazonaws.com/mozilla-games/emscripten/packages/llvm/tag/osx_32bit/index.txt': <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1076)>
Error downloading URL 'https://s3.amazonaws.com/mozilla-games/emscripten/packages/llvm/tag/osx_64bit/index.txt': <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1076)>
Installing SDK 'sdk-releases-fastcomp-5c6785a63993ae7a4d5362b32b0be9c85138fb96-64bit'..
Installing tool 'releases-fastcomp-5c6785a63993ae7a4d5362b32b0be9c85138fb96-64bit'..
Error downloading URL 'https://storage.googleapis.com/webassembly/emscripten-releases-builds/mac/5c6785a63993ae7a4d5362b32b0be9c85138fb96/wasm-binaries.tbz2': <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1076)>
Traceback (most recent call last):
  File "./emsdk", line 2756, in <module>
    sys.exit(main())
  File "./emsdk", line 2738, in main
    success = tool.install()
  File "./emsdk", line 1572, in install
    success = tool.install()
  File "./emsdk", line 1588, in install
    success = download_and_unzip(url, self.installation_path(), download_even_if_exists=download_even_if_exists, filename_prefix=filename_prefix)
  File "./emsdk", line 1142, in download_and_unzip
    assert received_download_target == download_target
AssertionError

[sbc100]

emsdk is shell script.. if you want to be sure it running under a given version of python use $ python ./emsdk.py

[Pethaudi]

(MacOSX 10.14.5)

Using python3 ./emsdk install latest didn't work. Using python 2.7 did work. Maybe try that.

[sbc100]

Can you test again with the latest emsdk. We've made some changes recently.

[Pethaudi]

Tried it again and it only works with Python2.7.

python3 ./emsdk.py install latest

Installing SDK 'sdk-releases-fastcomp-737d4a07be76c15124adf3c6ef2c218123f7a67f-64bit'..
Installing tool 'releases-fastcomp-737d4a07be76c15124adf3c6ef2c218123f7a67f-64bit'..
Error downloading URL 'https://storage.googleapis.com/webassembly/emscripten-releases-builds/mac/737d4a07be76c15124adf3c6ef2c218123f7a67f/wasm-binaries.tbz2': Traceback (most recent call last):
File "./emsdk.py", line 2895, in
sys.exit(main())
File "./emsdk.py", line 2875, in main
success = tool.install()
File "./emsdk.py", line 1654, in install
success = tool.install()
File "./emsdk.py", line 1676, in install
success = download_and_unzip(url, self.installation_path(), download_even_if_exists=download_even_if_exists, filename_prefix=filename_prefix)
File "./emsdk.py", line 1216, in download_and_unzip
assert received_download_target == download_target
AssertionError

[Hillsie]

I had a similar issue on my mac

<urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1076)>

And resolved it with the following steps.

At the terminal:

open /Applications/Python\ 3.7/Install\ Certificates.command

https://stackoverflow.com/a/57614113/6207266

Then

python3 ./emsdk.py install latest

This is a python certificates issue. Note the standard python version is 2.7 on Mac. Suggestion is to have multiple versions of python installed on OSX. Don't mess with the default version of python on mac

https://stackoverflow.com/a/1687456/6207266

Repeated issue, but found this a better solution to
https://github.com/emscripten-core/emscripten/issues/6275

[Krelborn]

I've just hit this on Catalina. I'm using a brew installed python 2.7.16 which was installed before the OS upgrade.

Anyway running python ./emsdk.py install latest works, while running the emsdk shell script is failing.

I also installed certifi (https://pypi.org/project/certifi/) which was in the link in the warning message from emsdk. Not sure if that actually helped, because I did that before trying to run through python directly.

Anyway, that got me up and running again, but would be interested to know what the right solution is.

[LanFly]

I had a similar issue on my MacOSX 10.13.5.

Installing SDK 'sdk-releases-upstream-9a89fff28cc6f75e17976fce1904b280e4beb25d-64bit'..
Installing tool 'node-12.9.1-64bit'..
Error: Downloading URL 'https://storage.googleapis.com/webassembly/emscripten-releases-builds/deps/node-v12.9.1-darwin-x64.tar.gz': <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:777)>
Warning: Possibly SSL/TLS issue. Update or install Python SSL root certificates (2048-bit or greater) supplied in Python folder or https://pypi.org/project/certifi/ and try again.
Installation failed!

And resolved it with the following steps.

python2.7 ./emsdk.py install latest

only python2.7 was succeed.

[sbc100]

Which version of python3 are you testing against? (What does which python3 say?)

For that matter what does which python and which python2.7 say? Are these all coming from the base system?

[restjohn]

Anyway running python ./emsdk.py install latest works, while running the emsdk shell script is failing.

The shell script forces the python interpreter to version 3 before running the python script. Running sudo /Applications/Python\ <VERSION>/Install\ Certificates.command to install the CA certs for python worked for me. I was then able to use ./emsdk install latest.

[Blake-Foust]

If you're on linux and you run the steps from the original site, in a conda env, it will download! The other solutions didn't work for me.

[robin-rpr]

$ brew install python3 has done the job for me. (Creates 'python' symlink)

[carrielin007]

I ran into the same SSL certificate verify failed #9036 issue when tried to run jupyter-lab to launch nltk. The problem is resolved as previous user(@Hillsie ) mentioned to run open /Applications/Python\ /Install\ Certificates.command. I'm using python 3.9 for it.

[mazmazz]

I faced this issue on Windows Server and I fixed it by point Python to the certifi certs via the SSL_CERT_FILE environment variable. Then install succeeded through emsdk.bat.

On PowerShell:

Start-Process -FilePath 'pip' -ArgumentList ('install','certifi') -Wait -NoNewWindow

$certifiPath = & 'python' -c 'import certifi; print(certifi.where())' | Out-String

$env:SSL_CERT_FILE = $certifiPath

I referenced this explanation from RedHat.

Old Notes

I attempted to install the certifi certs to Windows' Trusted Root store.

On Powershell:

pip install certifi

$certifiPath = & python -c "import certifi; print(certifi.where())"

Import-Certificate -FilePath "$certifiPath" -CertStoreLocation Cert:\LocalMachine\Root

EDIT: I had trouble reproducing this fix and instead resorted to downloading a cert from Google, see https://pki.goog/repository/ .

$certFile = New-TemporaryFile

Invoke-WebRequest -Uri "https://pki.goog/repo/certs/gsr2.pem" -UseBasicParsing -OutFile $certFile.FullName

Import-Certificate -FilePath $certFile.FullName -CertStoreLocation Cert:\LocalMachine\Root