Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I've got an inexpensive certificate from EssentialSSL (Comodo is the CA) and I was surprised to discover that Python didn't recognize it.

requests.exceptions.SSLError: [Errno 1] _ssl.c:509: error:14090086:SSL
routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

The certificate seems to be properly recognized by all major browsers, still Python does not validate it.

If possible I would prefer a simple install solution like the one of installing a package or a script.

I was a little bit surprised not to see Comodo in the default list of recognized CA certs, all major (5) browsers accept it but not Ubuntu wget/python/... (openssl i guess is the cause).

share|improve this question
1  
Comodo certs are present in Ubuntu, it could be that Python doesn't validate certificates based off the certificates available to the operating system. Alternatively, your certificate may not be part of a chain that leads back to one of the 3 Comodo certs that Ubuntu trusts. –  jackweirdy Dec 17 '13 at 11:56
    
@jackweirdy please check my comments from the response, it seems that Comodo Certificate is not included in the list, I also have a sample test file. –  sorin Dec 17 '13 at 17:07
    
    
run ls -l /etc/ssl/certs/ | grep -i comodo. You should see a number of comodo certificates there. –  jackweirdy Dec 17 '13 at 23:10

1 Answer 1

Use the Debian package ca-certificates which will incorporate (beside others) all CA certificates which Mozilla Firefox/Thunderbird/etc. uses.

You can use the certificate file (all certificates in one, PEM formatted) in Python as follows:

ssl_sock = ssl.wrap_socket(sock,  
                           ca_certs="/etc/ssl/certs/ca-certificates.crt",  
                           cert_reqs=ssl.CERT_REQUIRED  
                          )
share|improve this answer
1  
Where do you add that so the changes are system wide? –  Braiam Dec 17 '13 at 11:19
    
This is part of another library, I will test it first in order to see if this solves the problem and if true I will have to fix python distribution to make it work for any module. –  sorin Dec 17 '13 at 13:07
    
I tried your approach but it seems that the Comodo certificate is not inside /etc/ssl/certs/ca-certificates.crt -- you are free to test against https://sbarnea.com -- my OS X python validates the certificate but Ubuntu doesn't. –  sorin Dec 17 '13 at 16:01
    
Take a look at this test file gist.github.com/ssbarnea/8007689 it fails all test relates to my domain on Ubuntu which means that the /etc/ssl/certs/ca-certificates.crt does NOT contain COMODO certificates. –  sorin Dec 17 '13 at 16:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.