SSL module initialization error on Fedora Linux #114452

New Issue

Alexander Kovelenov · 2023-11-03T12:16:39+01:00

Alexander Kovelenov commented

2023-11-03 12:16:39 +01:00

System Information
Operating system: Fedora Linux 38
Graphics card: Nvidia GTX 1650

Blender Version
Broken: Blender 4.0 b27ff093ca
Worked: Blender 4.0 e9ad267151

Running request.urlopen() causes ssl.SSLError

Exact steps for others to reproduce the error

Run Blender, open Python Console, run the following code:

import urllib
from urllib import request
print(request.urlopen('https://blender.org').status)

It will print the crash backtrace (instead of status 200):

Traceback (most recent call last):
  File "<blender_console>", line 1, in <module>
  File "/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/urllib/request.py", line 216, in urlopen
    return opener.open(url, data, timeout)
  File "/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/urllib/request.py", line 519, in open
    response = self._open(req, data)
  File "/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/urllib/request.py", line 536, in _open
    result = self._call_chain(self.handle_open, protocol, protocol +
  File "/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/urllib/request.py", line 496, in _call_chain
    result = func(*args)
  File "/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/urllib/request.py", line 1391, in https_open
    return self.do_open(http.client.HTTPSConnection, req,
  File "/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/urllib/request.py", line 1317, in do_open
    h = http_class(host, timeout=req.timeout, **http_conn_args)
  File "/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/http/client.py", line 1422, in __init__
    context = ssl._create_default_https_context()
  File "/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/ssl.py", line 757, in create_default_context
    context = SSLContext(PROTOCOL_TLS_CLIENT)
  File "/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/ssl.py", line 496, in __new__
    self = _SSLContext.__new__(cls, protocol)
ssl.SSLError: [CONF: MODULE_INITIALIZATION_ERROR] module initialization error (_ssl.c:3093)

The code:

import ssl
print(ssl.get_default_verify_paths())

prints:

DefaultVerifyPaths(cafile='/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/site-packages/certifi/cacert.pem', capath='/etc/ssl/certs', openssl_cafile_env='SSL_CERT_FILE', openssl_cafile='/etc/ssl/cert.pem', openssl_capath_env='SSL_CERT_DIR', openssl_capath='/etc/ssl/certs')

The code:

import os
print(os.environ.get("SSL_CERT_FILE"))

prints:

/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/site-packages/certifi/cacert.pem

The issue started to reproduce after Blender 4.0 Beta build b27ff093ca. The last version that worked was Blender 4.0 Beta e9ad267151.

The issue also causes Verge3D plugin to crash since it uses python-based Tornado server running on localhost.

**System Information** Operating system: Fedora Linux 38 Graphics card: Nvidia GTX 1650 **Blender Version** Broken: Blender 4.0 b27ff093caa0 Worked: Blender 4.0 e9ad267151c9 **Running request.urlopen() causes ssl.SSLError** **Exact steps for others to reproduce the error** Run Blender, open Python Console, run the following code: ``` import urllib from urllib import request print(request.urlopen('https://blender.org').status) ``` It will print the crash backtrace (instead of status 200): ``` Traceback (most recent call last): File "<blender_console>", line 1, in <module> File "/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/urllib/request.py", line 216, in urlopen return opener.open(url, data, timeout) File "/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/urllib/request.py", line 519, in open response = self._open(req, data) File "/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/urllib/request.py", line 536, in _open result = self._call_chain(self.handle_open, protocol, protocol + File "/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/urllib/request.py", line 496, in _call_chain result = func(*args) File "/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/urllib/request.py", line 1391, in https_open return self.do_open(http.client.HTTPSConnection, req, File "/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/urllib/request.py", line 1317, in do_open h = http_class(host, timeout=req.timeout, **http_conn_args) File "/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/http/client.py", line 1422, in __init__ context = ssl._create_default_https_context() File "/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/ssl.py", line 757, in create_default_context context = SSLContext(PROTOCOL_TLS_CLIENT) File "/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/ssl.py", line 496, in __new__ self = _SSLContext.__new__(cls, protocol) ssl.SSLError: [CONF: MODULE_INITIALIZATION_ERROR] module initialization error (_ssl.c:3093) ``` The code: ``` import ssl print(ssl.get_default_verify_paths()) ``` prints: ``` DefaultVerifyPaths(cafile='/home/alex/apps/blender-4.0/4.0/python/lib/python3.10/site-packages/certifi/cacert.pem', capath='/etc/ssl/certs', openssl_cafile_env='SSL_CERT_FILE', openssl_cafile='/etc/ssl/cert.pem', openssl_capath_env='SSL_CERT_DIR', openssl_capath='/etc/ssl/certs') ``` The code: ``` import os print(os.environ.get("SSL_CERT_FILE")) ``` prints: ``` /home/alex/apps/blender-4.0/4.0/python/lib/python3.10/site-packages/certifi/cacert.pem ``` The issue started to reproduce after Blender 4.0 Beta build b27ff093caa0. The last version that worked was Blender 4.0 Beta e9ad267151c9. The issue also causes Verge3D plugin to crash since it uses python-based Tornado server running on localhost.

Alexander Kovelenov added the

labels 2023-11-03 12:16:40 +01:00

Alexander Kovelenov referenced this issue

2023-11-03 12:37:21 +01:00

Linux: SSL/HTTPS Request Unable to Get Local Issuer Certificate #102300

Alexander Kovelenov commented

2023-11-03 12:45:41 +01:00

Checked Ubuntu 22.04, appears to be working just fine.

Alexander Kovelenov commented

2023-11-03 12:49:38 +01:00

Strange thing, once the crash happens, the second exec:

print(request.urlopen('https://blender.org').status)

Won't crash, and prints 200.

Strange thing, once the crash happens, the second exec: ``` print(request.urlopen('https://blender.org').status) ``` Won't crash, and prints 200.

Alexander Kovelenov commented

2023-11-03 12:58:48 +01:00

Another strange thing, Blender 3.6 causes different kind of crash (CERTIFICATE_VERIFY_FAILED instead of MODULE_INITIALIZATION_ERROR), though Verge3D works on that version just fine:

Traceback (most recent call last):
  File "/home/alex/apps/blender-3.6/3.6/python/lib/python3.10/urllib/request.py", line 1348, in do_open
    h.request(req.get_method(), req.selector, req.data, headers,
  File "/home/alex/apps/blender-3.6/3.6/python/lib/python3.10/http/client.py", line 1283, in request
    self._send_request(method, url, body, headers, encode_chunked)
  File "/home/alex/apps/blender-3.6/3.6/python/lib/python3.10/http/client.py", line 1329, in _send_request
    self.endheaders(body, encode_chunked=encode_chunked)
  File "/home/alex/apps/blender-3.6/3.6/python/lib/python3.10/http/client.py", line 1278, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "/home/alex/apps/blender-3.6/3.6/python/lib/python3.10/http/client.py", line 1038, in _send_output
    self.send(msg)
  File "/home/alex/apps/blender-3.6/3.6/python/lib/python3.10/http/client.py", line 976, in send
    self.connect()
  File "/home/alex/apps/blender-3.6/3.6/python/lib/python3.10/http/client.py", line 1455, in connect
    self.sock = self._context.wrap_socket(self.sock,
  File "/home/alex/apps/blender-3.6/3.6/python/lib/python3.10/ssl.py", line 513, in wrap_socket
    return self.sslsocket_class._create(
  File "/home/alex/apps/blender-3.6/3.6/python/lib/python3.10/ssl.py", line 1071, in _create
    self.do_handshake()
  File "/home/alex/apps/blender-3.6/3.6/python/lib/python3.10/ssl.py", line 1342, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)

Another strange thing, Blender 3.6 causes different kind of crash (CERTIFICATE_VERIFY_FAILED instead of MODULE_INITIALIZATION_ERROR), though Verge3D works on that version just fine: ``` Traceback (most recent call last): File "/home/alex/apps/blender-3.6/3.6/python/lib/python3.10/urllib/request.py", line 1348, in do_open h.request(req.get_method(), req.selector, req.data, headers, File "/home/alex/apps/blender-3.6/3.6/python/lib/python3.10/http/client.py", line 1283, in request self._send_request(method, url, body, headers, encode_chunked) File "/home/alex/apps/blender-3.6/3.6/python/lib/python3.10/http/client.py", line 1329, in _send_request self.endheaders(body, encode_chunked=encode_chunked) File "/home/alex/apps/blender-3.6/3.6/python/lib/python3.10/http/client.py", line 1278, in endheaders self._send_output(message_body, encode_chunked=encode_chunked) File "/home/alex/apps/blender-3.6/3.6/python/lib/python3.10/http/client.py", line 1038, in _send_output self.send(msg) File "/home/alex/apps/blender-3.6/3.6/python/lib/python3.10/http/client.py", line 976, in send self.connect() File "/home/alex/apps/blender-3.6/3.6/python/lib/python3.10/http/client.py", line 1455, in connect self.sock = self._context.wrap_socket(self.sock, File "/home/alex/apps/blender-3.6/3.6/python/lib/python3.10/ssl.py", line 513, in wrap_socket return self.sslsocket_class._create( File "/home/alex/apps/blender-3.6/3.6/python/lib/python3.10/ssl.py", line 1071, in _create self.do_handshake() File "/home/alex/apps/blender-3.6/3.6/python/lib/python3.10/ssl.py", line 1342, in do_handshake self._sslobj.do_handshake() ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007) ```

Campbell Barton changed title from ~~SSL module initialization error on Linux~~ to SSL module initialization error on Fedora Linux

2023-11-04 05:03:55 +01:00

Campbell Barton referenced a pull request that will close this issue

2023-11-07 08:18:17 +01:00

WIP: Fix #114452: Disallow referencing /etc/ssl/openssl.cnf #114565

Campbell Barton referenced this issue

2023-11-07 10:53:54 +01:00

Build: prevent OpenSSL using /etc/ssl on macOS & Linux #114569

Campbell Barton commented

2023-11-07 11:00:54 +01:00

The problem is /etc/ssl/openssl.cnf on Fedora38 isn't compatible with the OpenSSL distributed by Blender - at least, the configuration fails to load. Replacing the /etc/ssl/openssl.cnf with the file from ArchLinux lets Blender load.

So from what I can see Blender shouldn't use /etc/ssl/ - since we can't guarantee the files here will be compatible with Blender's SSL. Submitted PR !114569.

For a short term workaround set OPENSSL_CONF=/dev/null which prevents the incompatible configuration being used.

The problem is `/etc/ssl/openssl.cnf` on Fedora38 isn't compatible with the OpenSSL distributed by Blender - at least, the configuration fails to load. Replacing the `/etc/ssl/openssl.cnf` with the file from ArchLinux lets Blender load. So from what I can see Blender shouldn't use `/etc/ssl/` - since we can't guarantee the files here will be compatible with Blender's SSL. Submitted PR !114569. For a short term workaround set `OPENSSL_CONF=/dev/null` which prevents the incompatible configuration being used.

Campbell Barton added

and removed