Using the Python pip install … command I was getting error message
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1019)
...
urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1019)On Discord, someone said the ca-certificates package seems to be missing on z/OS, I give a possible solution below.
How I fixed it see Upload the certificate from Linux.
I used Wireshark to monitor the web sites being used, and z/OS could not validate the certificate sent to it. It had a signing chain of 3 Certificate Authorities.
I tried capturing the certificates using openssl s_client…, but they didn’t work.
There is a pip option –trusted-host github.com –trusted-host 20.26.156.215 which says ignore the certificate validation from the specified sites. This did not work.
The pip command worked on Linux, so it was clearly a problem with certificates on z/OS.
I had zopen installed on my z/OS, and could issue the command
openssl s_client -connect github.com:443
This gave
subject=CN=github.com
issuer=C=GB, ST=Greater Manchester, L=Salford, O=..., CN=...Secure Server CA
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: ecdsa_secp256r1_sha256
Peer Temp Key: X25519, 253 bits
---
SSL handshake has read 3480 bytes and written 1605 bytes
Verification error: unable to get local issuer certificate This was much quicker than trying to wait for Pip to process the request.
Where does Python expect the certificates to be?
I executed a small Python program to display the paths used
COLIN:/u/colin: >python
Python 3.12.3 ....on zos
Type "help", "copyright", "credits" or "license" for more information.
import _ssl
print(_ssl.get_default_verify_paths())
quit()This gave
(‘SSL_CERT_FILE’, ‘/usr/local/ssl/cert.pem’, ‘SSL_CERT_DIR’, ‘/usr/local/ssl/certs’)
This was unexpected because I have openssl certificates in /usr/ssl/certs.
Upload the certificate from Linux
The Linux command
sudo apt reinstall ca-certificates
downloads the latest ca certificates into /etc/ssl/certs/ca-certificates.crt
I uploaded this to z/OS into /usr/local/ssl/cert.pem, for the Python code.
echo “aa” | openssl s_client -connect github.com:443 -verifyCAfile /etc/ssl/certs/ca-certificates.crt
worked. The certificate was verified.
I also uploaded it to /etc/ssl/certs/ca-certificates.crt for Python.
The openssl documentation
The openssl documentation discusses the location of the certificate store. The environment variable OPENSSLDIR locates where the certificate is stored, and how to download trusted certificates in a single file. Specifying OPENSSLDIR did not help.
ColinPaice 