Re: pkg/55212: python cannot verify SSL certificates

[Dieter Baron <dbaron%definitely.at@localhost>]

The following reply was made to PR pkg/55212; it has been noted by GNATS.

From: Dieter Baron <dbaron%definitely.at@localhost>
To: gnats-bugs%netbsd.org@localhost
Cc: 
Subject: Re: pkg/55212: python cannot verify SSL certificates
Date: Mon, 27 Apr 2020 12:22:49 +0200

 Hi,
 
 
 > On 27.04.2020, at 10:50, Leonardo Taccari <leot%NetBSD.org@localhost> wrote:
 >=20
 > The following reply was made to PR pkg/55212; it has been noted by =
 GNATS.
 >=20
 > From: Leonardo Taccari <leot%NetBSD.org@localhost>
 > To: gnats-bugs%NetBSD.org@localhost
 > Cc:=20
 > Subject: Re: pkg/55212: python cannot verify SSL certificates
 > Date: Mon, 27 Apr 2020 10:32:29 +0200
 >=20
 > Hello Dieter,
 >=20
 > dbaron%definitely.at@localhost writes:
 >> [...]
 >>> Description:
 >> Python 3.7 installed via pkgsrc fails to verify certificates that are =
 valid (as seen by all major browsers):
 >>=20
 >> urllib.error.URLError: <urlopen error [SSL: =
 CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get =
 local issuer certificate (_ssl.c:1076)>
 >>=20
 >>> How-To-Repeat:
 >> Run the following python 3 script:
 >>=20
 >> import urllib.request
 >>=20
 >> with urllib.request.urlopen("https://google.com/";) as request:
 >>        data =3D request.read()
 >>=20
 >>> Fix:
 >> I suspect Python and NetBSD/pkgsrc disagree over where the root =
 certificates are stored.
 >> [...]
 >=20
 > The real problem is probably that no certificates are installed.
 >=20
 > Please install security/mozilla-rootcerts-openssl (or populate
 > /etc/openssl/certs), that should address that problem.
 
 /etc/openssl/certs contained a bunch of certificates already. I =
 installed mozilla-rootcerts-openssl, but it did not fix the problem.
 
 Yours,
 dillo
 
 >=20