Seeing SSLError: [Errno 185090050] _ssl.c:340: error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib

I see a similar problem while running bandersnatcher on Ubuntu 10.04 LTS

```
bandersnatch==1.0dev
cov-core==1.7
coverage==3.6
distribute==0.6.35
mercurial==2.5.2
mock==1.0.1
py==1.4.13
pytest==2.3.4
pytest-cov==1.6
requests==1.1.0
virtualenv==1.6.1
wsgiref==0.1.2
```

```
2013-03-26 17:25:49,493 ERROR: Error syncing package: OpenCorePaste
Traceback (most recent call last):
  File "/srv/pypi/lib/python2.7/site-packages/bandersnatch-1.0dev-py2.7.egg/bandersnatch/package.py", line 56, in sync
    self.sync_release_files()
  File "/srv/pypi/lib/python2.7/site-packages/bandersnatch-1.0dev-py2.7.egg/bandersnatch/package.py", line 74, in sync_release_files
    self.download_file(release_file['url'], release_file['md5_digest'])
  File "/srv/pypi/lib/python2.7/site-packages/bandersnatch-1.0dev-py2.7.egg/bandersnatch/package.py", line 137, in download_file
    r = requests.get(url, stream=True)
  File "/srv/pypi/lib/python2.7/site-packages/requests-1.1.0-py2.7.egg/requests/api.py", line 55, in get
    return request('get', url, **kwargs)
  File "/srv/pypi/lib/python2.7/site-packages/requests-1.1.0-py2.7.egg/requests/api.py", line 44, in request
    return session.request(method=method, url=url, **kwargs)
  File "/srv/pypi/lib/python2.7/site-packages/requests-1.1.0-py2.7.egg/requests/sessions.py", line 279, in request
    resp = self.send(prep, stream=stream, timeout=timeout, verify=verify, cert=cert, proxies=proxies)
  File "/srv/pypi/lib/python2.7/site-packages/requests-1.1.0-py2.7.egg/requests/sessions.py", line 374, in send
    r = adapter.send(request, **kwargs)
  File "/srv/pypi/lib/python2.7/site-packages/requests-1.1.0-py2.7.egg/requests/adapters.py", line 213, in send
    raise SSLError(e)
SSLError: [Errno 185090050] _ssl.c:340: error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib
```

The error happens with https downloads from PyPI.


Can you upgrade to 1.2.0 and report if this still happens?


@zopyx could you also report on your version of openssl (`openssl version`).


I'm very tempted to close this since @zopyx is unresponsive.


Sorry but have you heard of the concept "holiday"?

> openssl version
> OpenSSL 0.9.8k 25 Mar 2009

I now moved my pypi-mirror to another host and the problem does not exisit on this machine.


Sorry but people abandoning bugs happens far too frequently. We've had tickets sit open for months because the original reporter won't respond. It gets frustrating after a while.

What is different between the machines? Versions of OpenSSL possibly? Versions of requests possibly? Version 1.2.0 included fixes in urllib3 that eliminated most of these ssl bugs. Still, I'd like to know if this ever happens again.


Additionally everytime I see bandersnatch come up on Distutils-sig I think of this issue. Bandersnatch seems like a great improvement and I want to make sure it works without issues from requests.


Tried with request 1.2.0 on the old machine....same problem


Thanks. I'll dig into this later this week but @t-8ch might have some insight on this that could wrap it up sooner.


Old box: 

pypi@lvps46-163-78-160:~$ cat /etc/issue
Ubuntu 10.04.4 LTS \n \l

New box:

cat /etc/issue
CentOS release 6.4 (Final)
Kernel \r on an \m

openssl version
OpenSSL 1.0.0-fips 29 Mar 2010


Hm. I do recall there being an issue with versions of OpenSSL older than 1.0.0 but I don't recall if it was directly related to this exact message. Again @t-8ch would know more about it if he has the chance to take a look.


- What does the following code show you (in the relevant venv)?
  (And does the file exist)

``` python
import requests.certs
print(requests.certs.where())
```

_Edit:_
Do you have `REQUESTS_CA_BUNDLE` set in your environment?
<\/edit>
- Does this happen with plain requests (`requests.get("https://httpbin.org")`?
- Where did you get python27 from?
- Does it work with the default python26?
- Which version of bandersnatch are you using?
- Does your bandersnatcher change the location of the cert bundle? (via the `verify=` parameter)

I can't reproduce this.

@sigmavirus24 My ubuntu container was slow to install :-)


Yeah I can't reproduce it either but I want to make sure bandersnatch isn't hampered by us


> > > import requests.certs
> > > print(requests.certs.where())
> > > /srv/pypi/lib/python2.7/site-packages/requests-1.2.0-py2.7.egg/requests/cacert.pem

No such environment variable exists.

requests.get("https://httpbin.org") is working

python 2.7 self-compiled

bandersnatch needs Python 2.7 afaik.


I assume the returned file exists, as the other call works.
Could you edit `requests/certs.py` to print out or log the path, it is returning from `where()` at actual runtime
Maybe some weird import magic is messing things up.
Which is your exact version (hg revision)?


@zopyx: Just wanted to remind you about this issue. =)


sorry, no time and meanwhile working on a different system. So I don't care

2013/4/8 Thomas Weißschuh notifications@github.com

> I assume the returned file exists, as the other call works.
> Could you edit requests/certs.py to print out or log the path, it is
> returning from where() at actual runtime
> Maybe some weird import magic is messing things up.
> Which is your exact version (hg revision)?
> 
> —
> Reply to this email directly or view it on GitHubhttps://github.com/kennethreitz/requests/issues/1265#issuecomment-16067154
> .


Hello,

I'm on Fedora 19 and coursera-dl tool failed for me on same error with python2.

```
$ python3
Python 3.3.2 (default, Aug 23 2013, 19:00:04) 
[GCC 4.8.1 20130603 (Red Hat 4.8.1-1)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import requests
>>> requests.get("https://httpbin.org")
/etc/ssl/certs/ca-certificates.crt
Traceback (most recent call last):
  File "/usr/lib/python3.3/site-packages/urllib3/util.py", line 382, in ssl_wrap_socket
    context.load_verify_locations(ca_certs)
FileNotFoundError: [Errno 2] No such file or directory

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.3/site-packages/requests/adapters.py", line 292, in send
    timeout=timeout
  File "/usr/lib/python3.3/site-packages/urllib3/poolmanager.py", line 255, in urlopen
    return super(ProxyManager, self).urlopen(method, url, redirect, **kw)
  File "/usr/lib/python3.3/site-packages/urllib3/poolmanager.py", line 155, in urlopen
    response = conn.urlopen(method, u.request_uri, **kw)
  File "/usr/lib/python3.3/site-packages/urllib3/connectionpool.py", line 454, in urlopen
    conn = self._get_conn(timeout=pool_timeout)
  File "/usr/lib/python3.3/site-packages/urllib3/connectionpool.py", line 272, in _get_conn
    return conn or self._new_conn()
  File "/usr/lib/python3.3/site-packages/urllib3/connectionpool.py", line 633, in _new_conn
    return self._prepare_conn(connection)
  File "/usr/lib/python3.3/site-packages/urllib3/connectionpool.py", line 604, in _prepare_conn
    connection.connect()
  File "/usr/lib/python3.3/site-packages/urllib3/connectionpool.py", line 127, in connect
    ssl_version=resolved_ssl_version)
  File "/usr/lib/python3.3/site-packages/urllib3/util.py", line 386, in ssl_wrap_socket
    raise SSLError(e)
urllib3.exceptions.SSLError: [Errno 2] No such file or directory

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.3/site-packages/requests/api.py", line 55, in get
    return request('get', url, **kwargs)
  File "/usr/lib/python3.3/site-packages/requests/api.py", line 44, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/lib/python3.3/site-packages/requests/sessions.py", line 335, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python3.3/site-packages/requests/sessions.py", line 438, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python3.3/site-packages/requests/adapters.py", line 331, in send
    raise SSLError(e)
requests.exceptions.SSLError: [Errno 2] No such file or directory
>>> 
```

Interesting is line 630 in `/usr/lib/python3.3/site-packages/urllib3/connectionpool.py` which creates new `HTTPSConnection` which uses default `ca_certs='/etc/ssl/certs/ca-certificates.crt'` in constructor, which references file that doesn't exist on Fedora/RHEL.

Simple workaround:

```
ln -s /etc/pki/tls/certs/ca-bundle.crt /etc/ssl/certs/ca-certificates.crt
```


This location is inserted by the downstream fedora packaging.
It seems they are already fixed this:
http://pkgs.fedoraproject.org/cgit/python-urllib3.git/commit/?id=4670672fa3bc24459a1a4468ab073a102f4d4a1c