Pkgdown: SSL certificate problem: certificate has expired

[DanielEWeeks]

The build_site command has stopped working for me (it was working earlier this morning) - after it prints out the 'Building home' message, it dies with this error message:

Error in curl::curl_fetch_memory(url, handle = handle) : 
  SSL certificate problem: certificate has expired
Error: callr subprocess failed: SSL certificate problem: certificate has expired

I'm not certain, but it looks like it is trying to access this URL "https://cloud.r-project.org/package=HuGen2070pipes" and is failing, even though it looks like the https://cloud.r-project.org SSL certificates are valid when I examine them in a regular web browser.

I am trying this from two different Macintosh computers. On the one, I am running R version 3.6.1 and pkgdown_1.4.1.

Thank you.

[nschiett]

I had exactly the same issue half an hour ago and have been trying to find a solution since. So far not successful. build_site() was working perfectly fine earlier today as well. Could this be a bug?

[DanielEWeeks]

I think it is more likely that the SSL certificate for whichever URL it is trying to access has expired.

[DanielEWeeks]

Actually, it is the BioConductor SSL certificate that has expired, as it is when 'build_site' is trying to access the "https://www.bioconductor.org/packages/HuGen2070pipes" that it generates the 'certificate has expired' error message.

And if I try to access https://www.bioconductor.org in my web browser, it doesn't want to go there, warning that "Your connection is not private".

[nschiett]

Hmm, I have absolutely no idea what is causing the error in my case. The deployment of the site still works: https://nschiett.github.io/fishualize/
However, trying to rebuild the site with build_site() gives back the error consistently, whereas before I had no issues..

Any help is very welcome. I must admit that I don't understand how the SSL certificate could be expired. Thanks!

[DanielEWeeks]

The BioConductor SSL certificate has expired, but others have noticed and notified the BioConductor team, so hopefully they will renew their certificate soon.

[nschiett]

Oh ok I see, thanks. Yes, fingers crossed!

[DavisVaughan]

A bit more insight into the exact problem.

This is the function that build_site() calls that fails:

https://github.com/r-lib/pkgdown/blob/320a59ffa9c6256c9d8ad8b0fc8066ecd7f3b266/R/build-home-index.R#L102

The job of this function is to generate the "Download from CRAN/Bioconductor" sidebar link.

I had this problem today as well.

My package is not yet on CRAN, so it fails for me because:

• The CRAN url check does not return anything useful
• So it falls through to the bioconductor url check
• It fails on that with the error we are all seeing about the SSL certificate

Luckily around 7pm on 2019-10-03 it seems to have resolved itself, as I was able to successfully build the site both locally and on Travis (I guess the SSL certificate is renewed).

[nschiett]

Thanks for the clarification! My package is not on CRAN yet either, so that must have been the problem for me too.
I just tried and luckily building the site works again!

[Haoen-Cui]

If your package is not on CRAN, then this chunk will not evaluate
https://github.com/r-lib/pkgdown/blob/320a59ffa9c6256c9d8ad8b0fc8066ecd7f3b266/R/build-home-index.R#L109-L111
and then this is where it failed due to the expired SSL certificate
https://github.com/r-lib/pkgdown/blob/320a59ffa9c6256c9d8ad8b0fc8066ecd7f3b266/R/build-home-index.R#L113-L115
During the downtime this afternoon, I got my package (not on CRAN nor Bioconductor) doc built by ignoring the SSL verification

httr::set_config(httr::config(ssl_verifypeer = 0L)) 
pkgdown::build_site(pkg = ".", new_process = FALSE)

I don't know much about internet security but this failure was pretty annoying to me and I can see it possibly happen again in the future. I'm wondering if the above offending lines should be modified to

bioc_url <- paste0("https://www.bioconductor.org/packages/", pkg)
req <- httr::HEAD(bioc_url, config = httr::config(ssl_verifypeer = 0L))

or maybe simply replace https with http

bioc_url <- paste0("http://www.bioconductor.org/packages/", pkg)
req <- httr::HEAD(bioc_url)

[pat-s]

I currently get this when building NEWS both locally and during CI runs

── Building news ───────────────────────────────────────────────────────────────────────────────────────
Error in curl::curl_fetch_memory(url, handle = handle) : 
  SSL certificate problem: certificate has expired

Error: <callr_status_error: callr subprocess failed: SSL certificate problem: certificate has expired>
-->
<callr_remote_error in curl::curl_fetch_memory(url, handle = handle):
 SSL certificate problem: certificate has expired>
 in process 21898 

See `.Last.error.trace` for a stack trace.

Maybe it resolves itself, let's wait a bit.

[krlmlr]

Getting it again when building NEWS: https://travis-ci.org/github/krlmlr/dm/jobs/677591111#L1151.

Should we display the URL that fails? I suspect no secrets will leak if we do.

[shatovkin]

to turn off the validation: git config http.sslVerify false

[jamesmedice]

try this
git config --global http.sslVerify false

[ocars]

try this
git config --global http.sslVerify false

Excellent James Thaks