- Mar 7, 2019
- 1,101
- 914
My server uses Cloudflare self signed certs, so no one would be able to securely connect to it except Cloudflare. And everyone else connects to Cloudflare, and I doubt they have invalid certs being used. So yeah something is probably going wrong either with your system's root CA or python's bundled ones (not sure if it does bundle them tho).Great idea for a fix!
On macOS, though, I'm getting SSL handshake errors when I try to refresh using beta 1229. Here's an example:
I imagine either the packaged version of Python's CA certs are out of date somewhere, or you're using a self-signed cert on your server? I can take a look if the cause isn't obvious.Code:Traceback (most recent call last): File "/Library/Frameworks/Python.framework/Versions/3.12/lib/python3.12/site-packages/aiohttp/connector.py", line 1080, in _wrap_create_connection File "uvloop/loop.pyx", line 2084, in create_connection File "uvloop/loop.pyx", line 2079, in uvloop.loop.Loop.create_connection File "uvloop/sslproto.pyx", line 517, in uvloop.loop.SSLProtocol._on_handshake_complete File "uvloop/sslproto.pyx", line 499, in uvloop.loop.SSLProtocol._do_handshake File "/Library/Frameworks/Python.framework/Versions/3.12/lib/python3.12/ssl.py", line 917, in do_handshake ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000) The above exception was the direct cause of the following exception: Traceback (most recent call last): File "/Users/runner/work/F95Checker/F95Checker/modules/api.py", line 566, in fast_check File "/Users/runner/work/F95Checker/F95Checker/modules/api.py", line 213, in fetch File "/Library/Frameworks/Python.framework/Versions/3.12/lib/python3.12/contextlib.py", line 210, in __aenter__ File "/Users/runner/work/F95Checker/F95Checker/modules/api.py", line 130, in request File "/Library/Frameworks/Python.framework/Versions/3.12/lib/python3.12/site-packages/aiohttp/client.py", line 1353, in __aenter__ File "/Library/Frameworks/Python.framework/Versions/3.12/lib/python3.12/site-packages/aiohttp/client.py", line 657, in _request File "/Library/Frameworks/Python.framework/Versions/3.12/lib/python3.12/site-packages/aiohttp/connector.py", line 564, in connect File "/Library/Frameworks/Python.framework/Versions/3.12/lib/python3.12/site-packages/aiohttp/connector.py", line 975, in _create_connection File "/Library/Frameworks/Python.framework/Versions/3.12/lib/python3.12/site-packages/aiohttp/connector.py", line 1350, in _create_direct_connection File "/Library/Frameworks/Python.framework/Versions/3.12/lib/python3.12/site-packages/aiohttp/connector.py", line 1319, in _create_direct_connection File "/Library/Frameworks/Python.framework/Versions/3.12/lib/python3.12/site-packages/aiohttp/connector.py", line 1082, in _wrap_create_connection aiohttp.client_exceptions.ClientConnectorCertificateError: Cannot connect to host api.f95checker.dev:443 ssl:True [SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)')] During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/Users/runner/work/F95Checker/F95Checker/modules/api.py", line 574, in fast_check UnboundLocalError: cannot access local variable 'res' where it is not associated with a value During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/Users/runner/work/F95Checker/F95Checker/modules/utils.py", line 87, in coro_wrapper File "/Users/runner/work/F95Checker/F95Checker/modules/api.py", line 1130, in refresh File "/Users/runner/work/F95Checker/F95Checker/modules/api.py", line 590, in fast_check UnboundLocalError: cannot access local variable 'last_changes' where it is not associated with a value
While working on all this I noticed that I was using ssl=False in aiohttp, probably from a time where younger and more naive me thought this was an acceptable fix for the issue. Unacceptable to use insecure ssl, so I re-enabled it, so it might be that you had this issue the whole time but aiohttp simply wasn't checking CA validity