Unable to access HTTPS URLs on Windows securely #1581

jaraco · 2024-05-30T16:12:13Z

Checklist

I've searched for similar issues.
I'm using the latest version of HTTPie.

Minimal reproduction code and steps

Install httpie using pipx install httpie
https google.com

Current result


https: error: SSLError: HTTPSConnectionPool(host='google.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)'))) while doing a GET request to URL: https://google.com/

Expected result

The resource should be loaded (ideally securely). It should be easy to use. Error messages should be informative and give the user direction on how to remedy the problem. Install docs should provide guidance on how to remedy the situation.

Debug output

Please re-run the command with --debug, then copy the entire command & output and paste both below:

 ~ # https --debug google.com
HTTPie 3.2.2
Requests 2.32.3
Pygments 2.18.0
Python 3.12.2 (tags/v3.12.2:6abddd9, Feb  6 2024, 21:26:36) [MSC v.1937 64 bit (AMD64)]
C:\Users\jaraco\AppData\Local\pipx\pipx\venvs\httpie\Scripts\python.exe
Windows 11

<Environment {'apply_warnings_filter': <function Environment.apply_warnings_filter at 0x000002248A99AA20>,
 'args': Namespace(),
 'as_silent': <function Environment.as_silent at 0x000002248A99A8E0>,
 'colors': 256,
 'config': {'default_options': []},
 'config_dir': WindowsPath('C:/Users/jaraco/AppData/Roaming/httpie'),
 'devnull': <property object at 0x000002248A946020>,
 'is_windows': True,
 'log_error': <function Environment.log_error at 0x000002248A99A980>,
 'program_name': 'https',
 'quiet': 0,
 'rich_console': <functools.cached_property object at 0x000002248A974260>,
 'rich_error_console': <functools.cached_property object at 0x000002248A975400>,
 'show_displays': True,
 'stderr': <colorama.ansitowin32.StreamWrapper object at 0x000002248A024D10>,
 'stderr_isatty': True,
 'stdin': <_io.TextIOWrapper name='<stdin>' mode='r' encoding='utf-8'>,
 'stdin_encoding': 'utf-8',
 'stdin_isatty': True,
 'stdout': <colorama.ansitowin32.StreamWrapper object at 0x000002248A881310>,
 'stdout_encoding': 'utf-8',
 'stdout_isatty': True}>

<PluginManager {'adapters': [],
 'auth': [<class 'httpie.plugins.builtin.BasicAuthPlugin'>,
          <class 'httpie.plugins.builtin.DigestAuthPlugin'>,
          <class 'httpie.plugins.builtin.BearerAuthPlugin'>],
 'converters': [],
 'formatters': [<class 'httpie.output.formatters.headers.HeadersFormatter'>,
                <class 'httpie.output.formatters.json.JSONFormatter'>,
                <class 'httpie.output.formatters.xml.XMLFormatter'>,
                <class 'httpie.output.formatters.colors.ColorFormatter'>]}>

>>> requests.request(**{'auth': None,
 'data': RequestJSONDataDict(),
 'headers': <HTTPHeadersDict('User-Agent': b'HTTPie/3.2.2')>,
 'method': 'get',
 'params': <generator object MultiValueOrderedDict.items at 0x000002248B38F790>,
 'url': 'https://google.com'})


https: error: SSLError: HTTPSConnectionPool(host='google.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)'))) while doing a GET request to URL: https://google.com/


Traceback (most recent call last):
  File "C:\Users\jaraco\AppData\Local\pipx\pipx\venvs\httpie\Lib\site-packages\urllib3\connectionpool.py", line 467, in _make_request
    self._validate_conn(conn)
  File "C:\Users\jaraco\AppData\Local\pipx\pipx\venvs\httpie\Lib\site-packages\urllib3\connectionpool.py", line 1099, in _validate_conn
    conn.connect()
  File "C:\Users\jaraco\AppData\Local\pipx\pipx\venvs\httpie\Lib\site-packages\urllib3\connection.py", line 653, in connect      
    sock_and_verified = _ssl_wrap_socket_and_match_hostname(
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\jaraco\AppData\Local\pipx\pipx\venvs\httpie\Lib\site-packages\urllib3\connection.py", line 806, in _ssl_wrap_socket_and_match_hostname
    ssl_sock = ssl_wrap_socket(
               ^^^^^^^^^^^^^^^^
  File "C:\Users\jaraco\AppData\Local\pipx\pipx\venvs\httpie\Lib\site-packages\urllib3\util\ssl_.py", line 465, in ssl_wrap_socket
    ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\jaraco\AppData\Local\pipx\pipx\venvs\httpie\Lib\site-packages\urllib3\util\ssl_.py", line 509, in _ssl_wrap_socket_impl
    return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Python312\Lib\ssl.py", line 455, in wrap_socket
    return self.sslsocket_class._create(
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Python312\Lib\ssl.py", line 1042, in _create
    self.do_handshake()
  File "C:\Python312\Lib\ssl.py", line 1320, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\Users\jaraco\AppData\Local\pipx\pipx\venvs\httpie\Lib\site-packages\urllib3\connectionpool.py", line 793, in urlopen  
    response = self._make_request(
               ^^^^^^^^^^^^^^^^^^^
  File "C:\Users\jaraco\AppData\Local\pipx\pipx\venvs\httpie\Lib\site-packages\urllib3\connectionpool.py", line 491, in _make_request
    raise new_e
urllib3.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "C:\Users\jaraco\AppData\Local\pipx\pipx\venvs\httpie\Lib\site-packages\requests\adapters.py", line 667, in send
    resp = conn.urlopen(
           ^^^^^^^^^^^^^
  File "C:\Users\jaraco\AppData\Local\pipx\pipx\venvs\httpie\Lib\site-packages\urllib3\connectionpool.py", line 847, in urlopen  
    retries = retries.increment(
              ^^^^^^^^^^^^^^^^^^
  File "C:\Users\jaraco\AppData\Local\pipx\pipx\venvs\httpie\Lib\site-packages\urllib3\util\retry.py", line 515, in increment
    raise MaxRetryError(_pool, url, reason) from reason  # type: ignore[arg-type]
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='google.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "C:\Users\jaraco\.local\bin\https.exe\__main__.py", line 7, in <module>
  File "C:\Users\jaraco\AppData\Local\pipx\pipx\venvs\httpie\Lib\site-packages\httpie\__main__.py", line 9, in main
    exit_status = main()
                  ^^^^^^
  File "C:\Users\jaraco\AppData\Local\pipx\pipx\venvs\httpie\Lib\site-packages\httpie\core.py", line 162, in main
    return raw_main(
           ^^^^^^^^^
  File "C:\Users\jaraco\AppData\Local\pipx\pipx\venvs\httpie\Lib\site-packages\httpie\core.py", line 136, in raw_main
    handle_generic_error(propagated_exc, annotation=annotation)
  File "C:\Users\jaraco\AppData\Local\pipx\pipx\venvs\httpie\Lib\site-packages\httpie\core.py", line 100, in raw_main
    exit_status = main_program(
                  ^^^^^^^^^^^^^
  File "C:\Users\jaraco\AppData\Local\pipx\pipx\venvs\httpie\Lib\site-packages\httpie\core.py", line 213, in program
    for message in messages:
  File "C:\Users\jaraco\AppData\Local\pipx\pipx\venvs\httpie\Lib\site-packages\httpie\client.py", line 113, in collect_messages  
    response = requests_session.send(
               ^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\jaraco\AppData\Local\pipx\pipx\venvs\httpie\Lib\site-packages\requests\sessions.py", line 703, in send
    r = adapter.send(request, **kwargs)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\jaraco\AppData\Local\pipx\pipx\venvs\httpie\Lib\site-packages\requests\adapters.py", line 698, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='google.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)')))

Additional information, screenshots, or code examples

In #792, another user had this issue and the recommendation was to bypass the security checks. If that's the recommended approach, and httpie want's to be a human-friendly CLI, it should just fall back to an insecure connection. Even better would be to provide the kinds of friendly experiences like Firefox or Edge provide and enable proper certificate validation of trusted roots.

I did try installing certifi, hoping that would improve the situation (pipx inject httpie certifi) but that did not help.

I did also try installing httpie using the recommended chocolatey installer, but that failed due to #1580.

The text was updated successfully, but these errors were encountered:

jaraco · 2024-05-30T16:21:53Z

I did inspect to see if the certificates were present, and they are:

 ~ # ~\AppData\Local\pipx\pipx\venvs\httpie\Scripts\python -c "import requests as r; print(r.certs.where())"
C:\USERS\JARACO\APPDATA\LOCAL\PIPX\PIPX\VENVS\HTTPIE\Lib\site-packages\certifi\cacert.pem

(that's without injecting certifi manually)

So it does seem like it should have suitable certificates to avoid this error.

I did find that running pipx inject httpie pip-system-certs works around the problem 🤮 .

michaelskyba · 2024-05-31T21:23:29Z

I have the same issue on Arch Linux. It only started when I updated to the 3.2.2-2 version of the httpie Arch package.

Edit: I didn't update my packages separately, so it's possible that it was an update to python-requests instead, which would be consistent with the downgrading comment below

$ https --debug google.com
HTTPie 3.2.2
Requests 2.32.3
Pygments 2.17.2
Python 3.12.3 (main, Apr 23 2024, 09:16:07) [GCC 13.2.1 20240417]
/usr/bin/python
Linux 6.9.1-arch1-1

<Environment {'apply_warnings_filter': <function Environment.apply_warnings_filter at 0x73a7a788e7a0>,
 'args': Namespace(),
 'as_silent': <function Environment.as_silent at 0x73a7a788e660>,
 'colors': 256,
 'config': {'default_options': []},
 'config_dir': PosixPath('/home/oboro/sync/config/httpie'),
 'devnull': <property object at 0x73a7a78854e0>,
 'is_windows': False,
 'log_error': <function Environment.log_error at 0x73a7a788e700>,
 'program_name': 'https',
 'quiet': 0,
 'rich_console': <functools.cached_property object at 0x73a7a89905f0>,
 'rich_error_console': <functools.cached_property object at 0x73a7a79964b0>,
 'show_displays': True,
 'stderr': <_io.TextIOWrapper name='<stderr>' mode='w' encoding='utf-8'>,
 'stderr_isatty': True,
 'stdin': <_io.TextIOWrapper name='<stdin>' mode='r' encoding='utf-8'>,
 'stdin_encoding': 'utf-8',
 'stdin_isatty': True,
 'stdout': <_io.TextIOWrapper name='<stdout>' mode='w' encoding='utf-8'>,
 'stdout_encoding': 'utf-8',
 'stdout_isatty': True}>

<PluginManager {'adapters': [],
 'auth': [<class 'httpie.plugins.builtin.BasicAuthPlugin'>,
          <class 'httpie.plugins.builtin.DigestAuthPlugin'>,
          <class 'httpie.plugins.builtin.BearerAuthPlugin'>],
 'converters': [],
 'formatters': [<class 'httpie.output.formatters.headers.HeadersFormatter'>,
                <class 'httpie.output.formatters.json.JSONFormatter'>,
                <class 'httpie.output.formatters.xml.XMLFormatter'>,
                <class 'httpie.output.formatters.colors.ColorFormatter'>]}>

>>> requests.request(**{'auth': None,
 'data': RequestJSONDataDict(),
 'headers': <HTTPHeadersDict('User-Agent': b'HTTPie/3.2.2')>,
 'method': 'get',
 'params': <generator object MultiValueOrderedDict.items at 0x73a7a76094e0>,
 'url': 'https://google.com'})


https: error: SSLError: HTTPSConnectionPool(host='google.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)'))) while doing a GET request to URL: https://google.com/


Traceback (most recent call last):
  File "/usr/lib/python3.12/site-packages/urllib3/connectionpool.py", line 715, in urlopen
    httplib_response = self._make_request(
                       ^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/urllib3/connectionpool.py", line 404, in _make_request
    self._validate_conn(conn)
  File "/usr/lib/python3.12/site-packages/urllib3/connectionpool.py", line 1058, in _validate_conn
    conn.connect()
  File "/usr/lib/python3.12/site-packages/urllib3/connection.py", line 419, in connect
    self.sock = ssl_wrap_socket(
                ^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/urllib3/util/ssl_.py", line 449, in ssl_wrap_socket
    ssl_sock = _ssl_wrap_socket_impl(
               ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/urllib3/util/ssl_.py", line 493, in _ssl_wrap_socket_impl
    return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/ssl.py", line 455, in wrap_socket
    return self.sslsocket_class._create(
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/ssl.py", line 1042, in _create
    self.do_handshake()
  File "/usr/lib/python3.12/ssl.py", line 1320, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.12/site-packages/requests/adapters.py", line 667, in send
    resp = conn.urlopen(
           ^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/urllib3/connectionpool.py", line 799, in urlopen
    retries = retries.increment(
              ^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/urllib3/util/retry.py", line 592, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='google.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/bin/https", line 8, in <module>
    sys.exit(main())
             ^^^^^^
  File "/usr/lib/python3.12/site-packages/httpie/__main__.py", line 9, in main
    exit_status = main()
                  ^^^^^^
  File "/usr/lib/python3.12/site-packages/httpie/core.py", line 162, in main
    return raw_main(
           ^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/httpie/core.py", line 136, in raw_main
    handle_generic_error(propagated_exc, annotation=annotation)
  File "/usr/lib/python3.12/site-packages/httpie/core.py", line 100, in raw_main
    exit_status = main_program(
                  ^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/httpie/core.py", line 213, in program
    for message in messages:
  File "/usr/lib/python3.12/site-packages/httpie/client.py", line 113, in collect_messages
    response = requests_session.send(
               ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/requests/sessions.py", line 703, in send
    r = adapter.send(request, **kwargs)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/requests/adapters.py", line 698, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='google.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)')))

wojciech-zurek · 2024-06-04T13:30:15Z

@michaelskyba to fix just downgrade python-requests package

sudo pacman -U https://archive.archlinux.org/packages/p/python-requests/python-requests-2.32.2-1-any.pkg.tar.zst

This fix works with the latest httpie version.

yay -Qs httpie
local/httpie 3.2.2-2

ncharaf · 2024-06-11T00:22:39Z

Hello,

Had the same issue & I mange to fix it by following this

PS D:\Nabil> https pie.dev/

https: error: SSLError: HTTPSConnectionPool(host='pie.dev', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)'))) while doing a GET request to URL: https://pie.dev/


PS D:\Nabil> pip install pip_system_certs
Collecting pip_system_certs
  Downloading pip_system_certs-4.0-py2.py3-none-any.whl.metadata (1.6 kB)
Collecting wrapt>=1.10.4 (from pip_system_certs)
  Downloading wrapt-1.16.0-cp312-cp312-win_amd64.whl.metadata (6.8 kB)
Downloading pip_system_certs-4.0-py2.py3-none-any.whl (6.1 kB)
Downloading wrapt-1.16.0-cp312-cp312-win_amd64.whl (37 kB)
Installing collected packages: wrapt, pip_system_certs
Successfully installed pip_system_certs-4.0 wrapt-1.16.0
PS D:\Nabil> https pie.dev/
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
CF-Cache-Status: DYNAMIC
CF-RAY: 891d70975a850350-CDG
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Tue, 11 Jun 2024 00:21:13 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TdxupDfRqex0HBSyXvHePa5NNNf1BfKIpG%2Fbia9DlV0riq%2FnWks5UVEaRyHRk4gBdQGc61La1SvGCD4osRYZ89XHn5jC4SfhY8O0d%2FBYiN%2BTYdvMqye%2FbitwQxh2fG62gBlgQU4%2F"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
alt-svc: h3=":443"; ma=86400

<!DOCTYPE html>
<html lang="en">

<head>

benwaffle · 2024-06-14T19:23:42Z

On arch, doing this fixed it:

pipx install httpie
pipx inject httpie pip-system-certs

jaraco added bug Something isn't working new Needs triage. Comments are welcome! labels May 30, 2024

jaraco mentioned this issue May 30, 2024

Ruff fails to build from source on Windows with Rust and Visual Studio installed astral-sh/ruff#11451

Closed

Ousret linked a pull request Jun 4, 2024 that will close this issue

Proposal 4.0 (HTTP/2+3, OS Trust Store, Custom DNS, OCSP, ...) #1531

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Unable to access HTTPS URLs on Windows securely #1581

Unable to access HTTPS URLs on Windows securely #1581

jaraco commented May 30, 2024

jaraco commented May 30, 2024 •

edited

Loading

michaelskyba commented May 31, 2024 •

edited

Loading

wojciech-zurek commented Jun 4, 2024 •

edited

Loading

ncharaf commented Jun 11, 2024

benwaffle commented Jun 14, 2024

Unable to access HTTPS URLs on Windows securely #1581

Unable to access HTTPS URLs on Windows securely #1581

Comments

jaraco commented May 30, 2024

Checklist

Minimal reproduction code and steps

Current result

Expected result

Debug output

Additional information, screenshots, or code examples

jaraco commented May 30, 2024 • edited Loading

michaelskyba commented May 31, 2024 • edited Loading

wojciech-zurek commented Jun 4, 2024 • edited Loading

ncharaf commented Jun 11, 2024

benwaffle commented Jun 14, 2024

jaraco commented May 30, 2024 •

edited

Loading

michaelskyba commented May 31, 2024 •

edited

Loading

wojciech-zurek commented Jun 4, 2024 •

edited

Loading