I have narrowed the problem down. This script works:
import sys
import traceback
import urllib.request
import requests
def processEvents():
try:
import slicer
slicer.app.processEvents()
except (AttributeError, ImportError):
pass
def display(text, file=sys.stdout):
processEvents()
print(text, flush=True, file=file)
def error(text):
display(text, file=sys.stderr)
for url, expected_success in [
("https://data.kitware.com", True),
("https://www.httpvshttps.com/", True),
("https://slicer.org/", True),
("https://expired.badssl.com/", False),
("https://github.com/", True),
]:
display("-" * 8)
display(f"Checking {url}")
goodCert = r"C:\Program Files\Python39\Lib\site-packages\certifi\cacert.pem"
badCert = requests.utils.DEFAULT_CA_BUNDLE_PATH # C:\Users\Dzenan\AppData\Local\.certifi
try:
with urllib.request.urlopen(url, cafile=goodCert) as response:
data = response.read()
html = data.decode('utf8')
assert "<head>" in html[:600]
if expected_success:
display(f"Checking {url} - OK")
else:
error(f"Checking {url} - FAILED - should have raised an exception")
except Exception as exc:
if expected_success:
error(f"Checking {url} - FAILED - unexpected exception")
traceback.print_exc()
else:
display(f"Checking {url} - OK [Expected {exc}]")
I tried copying goodCert into badCertās place. But when this script is run, the goodCert gets turned into badCert by extending it by a bunch more entries. The fileās size is increased from 253KB to 425KB.
If this certificate is not present in cacert.pem, the script works as it should. If this certificate is present, all websites have ācertificate has expiredā problem within Python.
I tried deleting it from the local computer, but it reappeared.
JC and I had a debugging session on my computer. We didnāt resolve the problem. But JC found this:
Starting with Python 2.7.9 and 3.2, the function āssl.create_default_context()ā automatically loads system certificates. This explains why the āSlicer.crtā we provide (through the SSL_CERT_FILE env. variable expected by openssl) is being ignored
I also figured out why the certificate comes back after I delete it:
And in text form for easier searching:
Deleting system root certificates might prevent some Windows components from working properly. The list of system critical root certificates can be reviewed at Microsoft Support. If Update Root Certificates is installed, any deleted third-party root certificates will be restored automatically, but the system root certificates will not. Do you want to delete the selected certificate(s)?
