python easy_install因所有软件包的SSL证书错误而失败

Question

目标:我正在使用RedHat 5并尝试为Web应用程序安装最新的python和django.

我成功地安装了python27和easy_install,并使用openssl进行了wget.

问题:但是现在我尝试从pypi.python.org获取任何内容我收到以下错误:

$ sudo easy_install --verbose django
Searching for django
Reading https://pypi.python.org/simple/django/
Download error on https://pypi.python.org/simple/django/: [Errno 1] _ssl.c:507: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed -- Some packages may not be found!
Couldn't find index page for 'django' (maybe misspelled?)
Scanning index of all packages (this may take a while)
Reading https://pypi.python.org/simple/
Download error on https://pypi.python.org/simple/: [Errno 1] _ssl.c:507: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed -- Some packages may not be found!
No local packages or download links found for django
error: Could not find suitable distribution for Requirement.parse('django')

我尝试使用openssl s_client -showcert -connect查找pypi.python.org的证书,但不知道如何处理它,在哪里存储它.关于谷歌的信息不多,需要专家的帮助.

谢谢!

编辑:我的意思是wget*with openssl.

$ wget http://ftp.gnu.org/gnu/wget/wget-1.15.tar.gz
$ tar -xzf wget-1.15.tar.gz
$ cd wget-1.15
$ ./configure --with-ssl=openssl
$ make
$ sudo make install

我也无法抓住页面:

$ wget https://pypi.python.org/simple/django/
--2014-01-21 11:18:45--  https://pypi.python.org/simple/django/
Resolving pypi.python.org (pypi.python.org)... 199.27.73.185, 199.27.74.184
Connecting to pypi.python.org (pypi.python.org)|199.27.73.185|:443... connected.
ERROR: cannot verify pypi.python.org's certificate, issued by ‘/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance CA-3’:
  Unable to locally verify the issuer's authority.
To connect to pypi.python.org insecurely, use `--no-check-certificate'.

Answer 1

你的curl证书太旧试着下载新的curl证书:

sudo wget http://curl.haxx.se/ca/cacert.pem -O /etc/pki/tls/certs/ca-bundle.crt

Answer 2

在寻找这个问题的解决方案之后我找到了这个页面.如果其他人有类似的问题,我找到的解决方案是:

在setuptools/ssl_support.py文件的开头(由easy_install使用,并且位于egg文件中:"./ lib/python2.7/site-package/setupup\_3.5.1-py2.7.egg" ),证书包文件在"cert_paths"变量中进行硬编码:

cert_paths = """
/etc/pki/tls/certs/ca-bundle.crt
/etc/ssl/certs/ca-certificates.crt
/usr/share/ssl/certs/ca-bundle.crt
/usr/local/share/certs/ca-root.crt
...etc..
"""

"easy_install"将使用此列表中存在的第一个文件,因为它称为"find_ca_bundle".如果此证书捆绑包文件中的证书已过期,则easy_install将因此SSL错误而失败.因此,需要更新证书文件或更改此ssl_support.py文件中的"cert_paths",以指向本地最新证书捆绑文件.