python - pip: cert failed, but curl works -


we installed our root cert on client, , https connection works curl.

but if try use pip, fails:

could not fetch url https://installserver:40443/pypi/simple/pep8/: there problem confirming ssl certificate:  <urlopen error [errno 1] _ssl.c:499: error:14090086:ssl routines:ssl3_get_server_certificate:certificate verify failed> 

the cert on client. see:

(foo_fm_qti)foo_fm_qti@vis-work:~$ curl -v https://installserver:40443/pypi/simple/pep8/ * connect() installserver port 40443 (#0) *   trying 127.0.0.1... connected * connected installserver (127.0.0.1) port 40443 (#0) * set certificate verify locations: *   cafile: none   capath: /etc/ssl/certs/ * sslv3, tls handshake, client hello (1): * sslv3, tls alert, client hello (1): * sslv3, tls handshake, server hello (2): * sslv3, tls handshake, cert (11): * sslv3, tls handshake, server key exchange (12): * sslv3, tls handshake, server finished (14): * sslv3, tls handshake, client key exchange (16): * sslv3, tls change cipher, client hello (1): * sslv3, tls handshake, finished (20): * sslv3, tls change cipher, client hello (1): * sslv3, tls handshake, finished (20): * ssl connection using dhe-rsa-aes256-sha * server certificate: *    subject: c=de; st=sachsen; l=chemnitz; o=foo-com gmbh; ou=dv; cn=gray.foo-com.lan; emailaddress=info@foo-com.de *    start date: 2013-09-09 10:47:50 gmt *    expire date: 2019-05-24 10:47:50 gmt *    subjectaltname: installserver matched *    issuer: c=de; st=sachsen; l=chemnitz; o=foo-com gmbh; cn=foo-com root ca; emailaddress=info@foo-com.de *    ssl certificate verify ok. > /pypi/simple/pep8/ http/1.1 

version: pip 1.4.1

unfortunately pip not use system certs, curl does.

i found solution:

pip --cert /etc/ssl/certs/foo_root_ca.pem install pep8 

this not nice (curl , other libraries find cert without adding parameter) works.

if don't want use command line argument, can set cert in ~/.pip/pip.conf:

[global] cert = /etc/ssl/certs/foo_root_ca.pem 

Comments

Popular posts from this blog

assembly - 8086 TASM: Illegal Indexing Mode -

Java, LWJGL, OpenGL 1.1, decoding BufferedImage to Bytebuffer and binding to OpenGL across classes -

javascript - addthis share facebook and google+ url -