I have narrowed the problem down. This script works:
import sys
import traceback
import urllib.request
import requests
def processEvents():
try:
import slicer
slicer.app.processEvents()
except (AttributeError, ImportError):
pass
def display(text, file=sys.stdout):
processEvents()
print(text, flush=True, file=file)
def error(text):
display(text, file=sys.stderr)
for url, expected_success in [
("https://data.kitware.com", True),
("https://www.httpvshttps.com/", True),
("https://slicer.org/", True),
("https://expired.badssl.com/", False),
("https://github.com/", True),
]:
display("-" * 8)
display(f"Checking {url}")
goodCert = r"C:\Program Files\Python39\Lib\site-packages\certifi\cacert.pem"
badCert = requests.utils.DEFAULT_CA_BUNDLE_PATH # C:\Users\Dzenan\AppData\Local\.certifi
try:
with urllib.request.urlopen(url, cafile=goodCert) as response:
data = response.read()
html = data.decode('utf8')
assert "<head>" in html[:600]
if expected_success:
display(f"Checking {url} - OK")
else:
error(f"Checking {url} - FAILED - should have raised an exception")
except Exception as exc:
if expected_success:
error(f"Checking {url} - FAILED - unexpected exception")
traceback.print_exc()
else:
display(f"Checking {url} - OK [Expected {exc}]")
I tried copying goodCert into badCert’s place. But when this script is run, the goodCert gets turned into badCert by extending it by a bunch more entries. The file’s size is increased from 253KB to 425KB.
If this certificate is not present in cacert.pem, the script works as it should. If this certificate is present, all websites have “certificate has expired” problem within Python.
I tried deleting it from the local computer, but it reappeared.
JC and I had a debugging session on my computer. We didn’t resolve the problem. But JC found this:
Starting with Python 2.7.9 and 3.2, the function “ssl.create_default_context()” automatically loads system certificates. This explains why the “Slicer.crt” we provide (through the SSL_CERT_FILE env. variable expected by openssl) is being ignored
I also figured out why the certificate comes back after I delete it:
And in text form for easier searching:
Deleting system root certificates might prevent some Windows components from working properly. The list of system critical root certificates can be reviewed at Microsoft Support. If Update Root Certificates is installed, any deleted third-party root certificates will be restored automatically, but the system root certificates will not. Do you want to delete the selected certificate(s)?
