1

Ubuntu 16.04 getting ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590) error in jenkins job while uploading files on production

In my .py file I have import httplib and urllib aslo Jenkins job running on ubuntu 16.04 and Job production is cent os 7

I have the following 21 lines python code:-

import httplib
import urllib
import os
import base64
AN=os.getenv("ACCESSNAME")
AP=os.getenv("ACCESSKEY")
U= 'login=%s&password=%s'%( 'Uname' , 'passwd' )
R = {'Authorization':'Basic '+base64.b64encode('%s:%s'%('Uname' , 'passwd' ))}
serverid = '192.168.0.*'
portno = 443
check_path='/store/shared/united_states'
h1=httplib.HTTPSConnection(serverid,portno)
if serverid=='192.168.0.*':
    h1.request('GET',"%s?%s"%(urllib.quote(check_path),U), None,R )
    print "connection successfull"
else:
    print "using 2ndUname login"
    h1.request('GET',check_path+'?login=2ndUname&password=passwd',None,{})
r1 = h1.getresponse()
statuscode=r1.HTTPS_PORT
print statuscode

It works on Ubuntu 12.04 but not on Ubuntu 16.04 On Ubuntu 16.04 it gives an error "ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)"

Certificate details:

CONNECTED(00000003)
---
Certificate chain
 0 s:/C=IE/ST=Dublin/L=Dublin/O=Default Company Ltd
   i:/C=IE/ST=Dublin/L=Dublin/O=Default Company Ltd
-----BEGIN CERTIFICATE-----
MIIDFjCCAf4CCQCgG89C0FwA9zANBgkqhkiG9w0BAQsFADBNMQswCQYDVQQGEwJJ
RTEPMA0GA1UECAwGRHVibGluMQ8wDQYDVQQHDAZEdWJsaW4xHDAaBgNVBAoME0Rl
ZmF1bHQgQ29tcGFueSBMdGQwHhcNMTgwMjEyMTYxNjU4WhcNMTkwMjEyMTYxNjU4
WjBNMQDVQQ1UECAwGRHVibGluMQ8wDQYDVQQHDAZEdWJswecffcerqwethhyrrre
aW4xHDAaBgNVBAoME0RlZmF1bHQgQ29tcGFueSBMdGQwggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQDp/GMnHTBzlVNIG/WjhLupxlWnQKL08AaYVo/6USav
jFcUFMupRuI4IMK2nuR4GUkQ6aYkqO8Vm83MokwVnSk+FVGs4mHkpcRwAuhQ61CD
vw9ZfSGJ3kaXbrcgZrtpjsNH5P3pne4/L73WI2fuQyDMVyoJFjbhQe/88qm/tXGS
qKxbdK/AtJkd/M1O7wd3GQzmklGTaabxP64Aut6zdq3ZUzs3r5yf5tsqre32rd2r
Uck3pUcmFW1MaYcwPbXNoOGFXWHWH+G8OliZd7y/y79MMW3YLrmzxxbcODccXih8
8mqMB8jd9UzOcI1XPCxgJ/VX6363yQqa1ih2oWNGqMEtAgMBAAEwDQYJKoZIhvcN
AQELBQADggEBAD32ABRkmFiVqg72XBsF0rq/BAhkjsgMZCyjrLdrYLMpkmPlvFbj
Qz6ZoXDuBup6+QrlekhAYHJPs0vVv/9yffHymBmX7nnYSiOdKt1e233rvyjg3234
76I3ZVp42hDqZpmlycQ6+sILOQYCh/9zgJMD8yXmptYk9AnM4T1fXacqbRUw760E
vUZJDNyE4l7hbsWlJ9cqio2ITHM4mSYGPtihDSyD6ZhO22ny4Xed2pzmVTwjUfbq
fg7pdhiv93gpc+W896b8oay6HGO9q0g1DsGt7RdINbnHk+srCcBinZpn+HEqFqBi
q6vCYoqH7NVMQ4/y6M3tvqb1xg2TOI9VWno=
-----END CERTIFICATE-----
---
Server certificate
subject=/C=IE/ST=Dublin/L=Dublin/O=Default Company Ltd
issuer=/C=IE/ST=Dublin/L=Dublin/O=Default Company Ltd
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 1485 bytes and written 431 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: A986151BD77C7B6BCC96E87C88C9463A794A3A9C34CA6AAE0B3012E5BCCC9053
    Session-ID-ctx: 
    Master-Key: 5899F9E0C15D2CE071A8F6DBF36FD74F1137BA492A3D6383D7A0D5A36F46AB993CC5F740E87440C21B54ABCE3F7B6DC1
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - bd b6 8a 7d 9e ed 63 09-f4 93 4b e4 ad 4e e5 5c   ...}..c...K..N.\
    0010 - dd a9 69 2a ce 10 3c 81-df 14 b5 c1 2f 44 79 0c   ..i*..<...../Dy.
    0020 - 06 46 7d e4 c0 99 9c 23-32 6c b9 4b 85 b6 e6 6b   .F}....#2l.K...k
    0030 - 44 ae 14 44 6c 0a 22 4b-0f 25 24 80 d2 72 49 dd   D..Dl."K.%$..rI.
    0040 - 25 1f 07 91 f4 fe 40 3d-e6 1a 60 c3 30 83 88 71   %.....@=..`.0..q
    0050 - 05 dd a1 89 41 47 33 0d-8f 09 16 69 f1 bb 5a c7   ....AG3....i..Z.
    0060 - da 7a 5c e7 fb a5 53 f5-09 9c de 50 c3 de ac f7   .z\...S....P....
    0070 - 09 27 29 32 c3 d3 99 6a-d8 50 3c 06 a2 7a e5 ce   .')2...j.P<..z..
    0080 - 3b 77 12 7e 9f b6 c1 cb-42 ff a2 44 aa 89 a9 13   ;w.~....B..D....
    0090 - f6 b7 94 71 86 db ff af-6d 95 bb 3b 9e 0e 3f 4a   ...q....m..;..?J
    00a0 - 6c df 87 7a fc 9b 94 48-17 8b 24 db 9f 4c 84 e8   l..z...H..$..L..
    00b0 - b6 4c 11 6b be 55 84 8e-f8 0d 44 b4 6f b0 9f 81   .L.k.U....D.o...

    Start Time: 1553235005
    Timeout   : 300 (sec)
    Verify return code: 10 (certificate has expired)
---
HTTP/1.1 400 Bad Request
Date: Fri, 22 Mar 2019 06:14:21 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/3.4 Python/2.7.5
Content-Length: 226
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<br />
</p>
</body></html>
  • Do you have valid server certificates? – vidarlo Mar 8 '19 at 6:12
  • I have newly installed Ubuntu 16.04 system with valid certificates – Ajit Mar 8 '19 at 6:16
  • The following code works on Ubu ntu 12.04 but not on Ubuntu 16.04 – Ajit Mar 8 '19 at 6:16
  • So you have a valid certificate on the server that the client can verify against either a provided CA, or is included in Ubuntu's standard CA list? – vidarlo Mar 8 '19 at 6:17
  • We did not include any certificates in Ubuntu 16.04 standard CA list – Ajit Mar 8 '19 at 6:23
1

Your certificate is expired according to the output you provided. Furthermore, it has some dubious entries in the Organization field, so I would guess it's self signed as well...

Get a new, valid certificate from for instance Let's Encrypt, or configure a working PKI structure within your company, for instance using EasyRSA.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.