# New extension manager and issues with corporate certificates

**URL:** <https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361>\
**Category:** Support\
**Tags:** extensions-manager\
**Created:** [August 25, 2021, 6:39pm UTC](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361 "2021-08-25T18:39:59Z")\
**Posts on this page:** 17\
**Page:** 2

<div class="post-metadata">

**Author:** ![muratmaga](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.slicer.org/muratmaga/32/83011_2.png) [@muratmaga](https://discourse.slicer.org/u/muratmaga)\
**Post date:** [September 14, 2021, 7:09pm UTC](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361/22 "2021-09-14T19:09:55Z")

</div>

> [@lassoan](#):
>
> You may be able to add your self-signed certificate to the certificate file in share\Slicer-4.13\Slicer.crt. See more information [here](https://github.com/Slicer/Slicer/tree/master/Base/QTCore/Resources/Certs).

Manually adding the certificates inside the Slicer.crt fixed the problem. I can now use the extension manager.

But where do we go from here? This is not a solution for us, just in our center there about 30-40 different installations of Slicer in dozens of computers (each user account needs to be fixed individually). There are many other clinical centers and researchers at SCH who use Slicer that will suffer from this.

@mikebind @ezgimercan do you encounter this certificate issue at your work computers? (try with a new installation)

---

<div class="post-metadata">

**Author:** ![lassoan](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.slicer.org/lassoan/32/13_2.png) [@lassoan](https://discourse.slicer.org/u/lassoan)\
**Post date:** [September 14, 2021, 7:56pm UTC](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361/23 "2021-09-14T19:56:18Z")

</div>

> [@muratmaga](#):
>
> But where do we go from here? This is not a solution for us

Try to figure out why `wget` does not have this issue.

- Is it because curl can find the certificate on your system? Can you check where self-signed certificates are stored on your computer?
- Maybe because curl uses the system OpenSSL? You can consult with @jcfr, currently evaluating building Slicer without bundling OpenSSL - see [#5663](https://github.com/Slicer/Slicer/issues/5663))
- Is it because SSL verification is turned off? By default it should be enabled, but if your system has a special OpenSSL configuration and the user is not concerned about security then we could allow disabling SSL verification.

> [@muratmaga](#):
>
> do you encounter this certificate issue at your work computers? (try with a new installation)

Only about 1 of 10 Slicer downloads are on Linux, and they are expected to be able to deal with things like installing self-signed certificates. It would be important to know if this is an issue on Windows and macOS as well.

---

<div class="post-metadata">

**Author:** ![muratmaga](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.slicer.org/muratmaga/32/83011_2.png) [@muratmaga](https://discourse.slicer.org/u/muratmaga)\
**Post date:** [September 14, 2021, 8:34pm UTC](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361/24 "2021-09-14T20:34:32Z")

</div>

> [@lassoan](#):
>
> Only about 1 of 10 Slicer downloads are on Linux, and they are expected to be able to deal with things like installing self-signed certificates. It would be important to know if this is an issue on Windows and macOS as well.

This happens on both windows and Linux computers that are connected to our network. We are primarily a windows shop, which is the concern. As you said, most Linux users are used to following these kinds of instructions, but quite concerning for windows.

Our windows desktops use a centralized image, in which I presume the certificates are baked. I can try to find path where those are, if that’s helpful.

---

<div class="post-metadata">

**Author:** ![lassoan](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.slicer.org/lassoan/32/13_2.png) [@lassoan](https://discourse.slicer.org/u/lassoan)\
**Post date:** [September 14, 2021, 8:44pm UTC](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361/25 "2021-09-14T20:44:38Z")

</div>

On Windows, there is a certificate store where you all the trusted certificates are saved to. It would be nice if you could check that Python `curl` and `requests` retrieve certificates from there (you can try that for example by temporarily removing your self-signed certification from the store).

By the way, I don’t understand how a large organization cannot afford to pay a few hundred dollars to get the certificate properly registered. This investigation already costs more than what they would need to pay for it. Doesn’t this untrusted certificate cause all kinds of issues for many other applications? How can you connect devices that do not allow installing self-signed certificates?

---

<div class="post-metadata">

**Author:** ![muratmaga](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.slicer.org/muratmaga/32/83011_2.png) [@muratmaga](https://discourse.slicer.org/u/muratmaga)\
**Post date:** [September 14, 2021, 8:46pm UTC](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361/26 "2021-09-14T20:46:56Z")

</div>

> [@lassoan](#):
>
> By the way, I don’t understand how a large organization cannot afford to pay a few hundred dollars to get the certificate properly registered. This investigation already costs more than what they would need to pay for it. Doesn’t this untrusted certificate cause all kinds of issues for many other applications? How can you connect devices that do not allow installing self-signed certificates?

I have no idea why they are not doing this, and I unfortunately i have no answer for it…

---

<div class="post-metadata">

**Author:** ![mikebind](https://avatars.discourse-cdn.com/v4/letter/m/71e660/32.png) [@mikebind](https://discourse.slicer.org/u/mikebind)\
**Post date:** [September 14, 2021, 9:24pm UTC](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361/27 "2021-09-14T21:24:47Z")

</div>

I primarily work on my personal laptop, but I can confirm that I ran into the same problem on computers within the hospital corporate network, @muratmaga.

---

<div class="post-metadata">

**Author:** ![jcfr](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.slicer.org/jcfr/32/17825_2.png) [@jcfr](https://discourse.slicer.org/u/jcfr)\
**Post date:** [September 14, 2021, 10:07pm UTC](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361/28 "2021-09-14T22:07:29Z")

</div>

> [@muratmaga](#):
>
> Manually adding the certificates inside the Slicer.crt fixed the problem.

Could you try using the updated `Slicer.crt` associated with [https://github.com/Slicer/Slicer/pull/5855](https://github.com/Slicer/Slicer/pull/5855) ?

For reference, certificate bundle was re-generated following these instructions. See [Base/QTCore/Resources/Certs#readme](https://github.com/Slicer/Slicer/tree/master/Base/QTCore/Resources/Certs#readme)

Moving forward, I suggest we also add a weekly GitHub Actions workflow that would be automatically run the script and create a pull-request.

---

<div class="post-metadata">

**Author:** ![muratmaga](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.slicer.org/muratmaga/32/83011_2.png) [@muratmaga](https://discourse.slicer.org/u/muratmaga)\
**Post date:** [September 14, 2021, 10:22pm UTC](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361/29 "2021-09-14T22:22:06Z")

</div>

> [@jcfr](#):
>
> Could you try using the updated `Slicer.crt` associated with [https://github.com/Slicer/Slicer/pull/5855](https://github.com/Slicer/Slicer/pull/5855) ?
> 
> For reference, certificate bundle was re-generated following these instructions. See [Base/QTCore/Resources/Certs#readme](https://github.com/Slicer/Slicer/tree/master/Base/QTCore/Resources/Certs#readme)

If you mean, I just replace the default Slicer.crt in today’s preview with this one, it didn’t work. (same issue with extension manager).

---

<div class="post-metadata">

**Author:** ![pieper](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.slicer.org/pieper/32/8_2.png) [@pieper](https://discourse.slicer.org/u/pieper)\
**Post date:** [September 14, 2021, 10:29pm UTC](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361/30 "2021-09-14T22:29:04Z")

</div>

I believe Jc meant to download [this one](https://raw.githubusercontent.com/Slicer/Slicer/6fb5dcb4362756ccca2a88cc2009b5d1734bad9a/Base/QTCore/Resources/Certs/Slicer.crt) and if it works then he’ll merge the PR and it will be in tomorrow’s preview.

---

<div class="post-metadata">

**Author:** ![lassoan](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.slicer.org/lassoan/32/13_2.png) [@lassoan](https://discourse.slicer.org/u/lassoan)\
**Post date:** [September 15, 2021, 12:32am UTC](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361/31 "2021-09-15T00:32:17Z")

</div>

As far as I understand, the problem is that the certificate that @muratmaga’s institution is using is not trusted (self-signed). This untrusted certificate has to be manually merged into the Slicer.crt file.

The interesting thing is that curl in the Slicer interpreter works. It would be nice to do the same what curl does.

---

<div class="post-metadata">

**Author:** ![jcfr](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.slicer.org/jcfr/32/17825_2.png) [@jcfr](https://discourse.slicer.org/u/jcfr)\
**Post date:** [September 15, 2021, 8:56am UTC](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361/32 "2021-09-15T08:56:53Z")

</div>

### Updates

Every Tuesday at 11.30am UTC (7.30am ET), a GitHub workflow will now be triggered to re-generate the `Slicer.crt` bundle and create a pull-request if has changed since the last run. See [update-slicer-certificate-bundle.yml](https://github.com/Slicer/Slicer/blob/master/.github/workflows/update-slicer-certificate-bundle.yml)

---

<div class="post-metadata">

**Author:** ![muratmaga](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.slicer.org/muratmaga/32/83011_2.png) [@muratmaga](https://discourse.slicer.org/u/muratmaga)\
**Post date:** [September 15, 2021, 3:18pm UTC](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361/33 "2021-09-15T15:18:36Z")

</div>

> [@pieper](#):
>
> I believe Jc meant to download [this one](https://raw.githubusercontent.com/Slicer/Slicer/6fb5dcb4362756ccca2a88cc2009b5d1734bad9a/Base/QTCore/Resources/Certs/Slicer.crt) and if it works then he’ll merge the PR and it will be in tomorrow’s preview.

That’s what I did. Downloaded that crt file, overwrite the one preview version came with. Had no effect (errors persist). As Andras said the only mitigating solution we have right now is to copy and paste the root certificates in SLicer’s certificate. But since this needs to be done on per user basis, it is not much of a solution.

As also andras pointed out I do NOT encounter the SSL handshake error when I use [wget inside the Slicer’s python environment](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361/7), but get the error if I try to access the file directly via [QT](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361/11). So somehow wget is finding the correct certificates from the windows and but not QT.

---

<div class="post-metadata">

**Author:** ![lassoan](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.slicer.org/lassoan/32/13_2.png) [@lassoan](https://discourse.slicer.org/u/lassoan)\
**Post date:** [September 15, 2021, 4:55pm UTC](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361/34 "2021-09-15T16:55:37Z")

</div>

> [@muratmaga](#):
>
> So somehow wget is finding the correct certificates from the windows and but not QT.

Have you confirmed that wget does not simply skip the SSL verification? Does wget fail if you temporarily remove the self-signed certificate from your system?

Have you checked if you disable SSL verification in the Qt request then it completes successfully?

Could you ask your IT admins about why don’t they get a proper certificate from a trusted authority? If there is a valid use case then it can justify investing Slicer development time into this; but if this is just a bad decision of a single organization then it does not make sense for Slicer developers to pay the price.

---

<div class="post-metadata">

**Author:** ![muratmaga](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.slicer.org/muratmaga/32/83011_2.png) [@muratmaga](https://discourse.slicer.org/u/muratmaga)\
**Post date:** [September 15, 2021, 5:12pm UTC](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361/35 "2021-09-15T17:12:09Z")

</div>

It is not easy to remove the certificates fro`

> [@lassoan](#):
>
> Have you confirmed that wget does not simply skip the SSL verification? Does wget fail if you temporarily remove the self-signed certificate from your system?

It is not easy to remove the certificates from these windows boxes as far as I can tell. In normal wget you have to explicitly specify to skip ssl via --no-check-certificate parameter. I am not how it is done in its python implementation, but will check.

> [@lassoan](#):
>
> Could you ask your IT admins about why don’t they get a proper certificate from a trusted authority? If there is a valid use case then it can justify investing Slicer development time into this; but if this is just a bad decision of a single organization then it does not make sense for Slicer developers to pay the price.

I agree and already reached out to the institutional security team that this is turning to be a big issue for us. However, whatever/why ever they are doing is not impacting regular windows operation. So from their perspective this is also a corner case that they need to get more info to come up with a solution. It appears to be a combination of QT and Slicer build settings. The only other QT based application I used on these windows machines is Rstudio, and I have no issue getting https:// resources on them (no handshake error).

---

<div class="post-metadata">

**Author:** ![lassoan](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.slicer.org/lassoan/32/13_2.png) [@lassoan](https://discourse.slicer.org/u/lassoan)\
**Post date:** [September 15, 2021, 6:08pm UTC](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361/36 "2021-09-15T18:08:07Z")

</div>

> [@muratmaga](#):
>
> It is not easy to remove the certificates from these windows boxes as far as I can tell.

You can open the local machine certificate manager by hitting the windows key and typing `certlm.msc`. You can then find the self-signed certificate and disable all uses, restart the computer, and see if wget in python still works.

You can also [run wget step by step in a Python debugger](https://github.com/SlicerRt/SlicerDebuggingTools/blob/master/README.md#debuggingtools-extension-for-3d-slicer) to see what certificates it is using and from where it gets them.

---

<div class="post-metadata">

**Author:** ![muratmaga](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.slicer.org/muratmaga/32/83011_2.png) [@muratmaga](https://discourse.slicer.org/u/muratmaga)\
**Post date:** [January 5, 2023, 8:56pm UTC](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361/37 "2023-01-05T20:56:15Z")

</div>

> [@lassoan](#):
>
> then

This is back for me, this time on a MacOS computer attached to the corporate network. The funny thing it was working fine until last week. When I try to download a sample file (like MRHead) I am getting certificate error.

When I used the test snipped above, I am getting error code 200, which says “Unknown Error”

> > >

```auto
url = qt.QUrl("https://slicer-packages.kitware.com/api/v1/file/613b26b1342a877cb3bee81e/download")

request = qt.QNetworkRequest(url)

manager = qt.QNetworkAccessManager()

reply = manager.get(request)

while (not reply.isFinished()):

slicer.app.processEvents()

localFile = qt.QFile("/Users/amaga/downloaded2.zip")

localFile.open(qt.QIODevice.WriteOnly)

localFile.write(reply.readAll());

localFile.close()

print(f"HTTP response code: {reply.attribute(qt.QNetworkRequest.HttpStatusCodeAttribute)}")

print(f"Error code: {reply.error()}")

HTTP response code: 200

Error code: 0

>>>

>>> reply.errorString()

'Unknown error'

```

Like before, this URL downloads fine from firefox or safari browsers on the same computer, attached to the same network.

---

<div class="post-metadata">

**Author:** ![jcfr](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.slicer.org/jcfr/32/17825_2.png) [@jcfr](https://discourse.slicer.org/u/jcfr)\
**Post date:** [January 5, 2023, 10:04pm UTC](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361/38 "2023-01-05T22:04:54Z")

</div>

> certificate error

Since the scheduled workflow [Update Slicer.crt certificate bundle](https://github.com/Slicer/Slicer/actions/workflows/update-slicer-certificate-bundle.yml) didn’t lead to an update, we will need to further investigate.

[Previous page](https://discourse.slicer.org/t/new-extension-manager-and-issues-with-corporate-certificates/19361.md?page=1)