调用 apiclient.discovery.build 时 URL 的 SSL 证书无效 and/or

Question

所以我运行我的 google 本地端点与 dev_appserver.py。我使用 API 资源管理器来测试应用程序。

我用来创建服务的代码如下：

from apiclient.discovery import build 
from oauth2client.client import GoogleCredentials
credentials = GoogleCredentials.get_application_default()
service = build('speech', 'v1beta1', credentials=credentials)

我收到 SSL 错误（无效 and/or 缺少 SSL 证书），即使当我通过浏览器访问所述 URL 时它工作正常（即显示绿色挂锁）。

我不确定发生了什么变化，但不久前它运行良好。

我试图禁用 SSL 检查，但无法。

完整日志如下：

INFO     2017-01-02 03:12:02,724 discovery.py:267] URL being requested: GET https://www.googleapis.com/discovery/v1/apis/speech/v1beta1/rest?userIp=0.2.0.3
ERROR    2017-01-02 03:12:03,022 wsgi.py:263] 
Traceback (most recent call last):
  File "/home/vini/opt/google-cloud-sdk/platform/google_appengine/google/appengine/runtime/wsgi.py", line 240, in Handle
    handler = _config_handle.add_wsgi_middleware(self._LoadHandler())
  File "/home/vini/opt/google-cloud-sdk/platform/google_appengine/google/appengine/runtime/wsgi.py", line 299, in _LoadHandler
    handler, path, err = LoadObject(self._handler)
  File "/home/vini/opt/google-cloud-sdk/platform/google_appengine/google/appengine/runtime/wsgi.py", line 85, in LoadObject
    obj = __import__(path[0])
  File "/mnt/b117/home/vini/udacity/cerci-endpoint/api.py", line 28, in <module>
    service = build('speech', 'v1beta1', credentials=credentials)
  File "/mnt/b117/home/vini/udacity/cerci-endpoint/lib/oauth2client/_helpers.py", line 133, in positional_wrapper
    return wrapped(*args, **kwargs)
  File "/mnt/b117/home/vini/udacity/cerci-endpoint/lib/googleapiclient/discovery.py", line 222, in build
    cache)
  File "/mnt/b117/home/vini/udacity/cerci-endpoint/lib/googleapiclient/discovery.py", line 269, in _retrieve_discovery_doc
    resp, content = http.request(actual_url)
  File "/mnt/b117/home/vini/udacity/cerci-endpoint/lib/httplib2/__init__.py", line 1609, in request
    (response, content) = self._request(conn, authority, uri, request_uri, method, body, headers, redirections, cachekey)
  File "/mnt/b117/home/vini/udacity/cerci-endpoint/lib/httplib2/__init__.py", line 1351, in _request
    (response, content) = self._conn_request(conn, request_uri, method, body, headers)
  File "/mnt/b117/home/vini/udacity/cerci-endpoint/lib/httplib2/__init__.py", line 1307, in _conn_request
    response = conn.getresponse()
  File "/home/vini/opt/google-cloud-sdk/platform/google_appengine/google/appengine/dist27/gae_override/httplib.py", line 532, in getresponse
    raise HTTPException(str(e))
HTTPException: Invalid and/or missing SSL certificate for URL: https://www.googleapis.com/discovery/v1/apis/speech/v1beta1/rest?userIp=0.2.0.3

知道是什么导致了这个问题吗？

我是否必须 "install" 或更新 python 使用的 SSL 证书？

Answer 1

根据 App Engine issue 13477 看来 urlfetch_cacerts.txt 中包含在 App Engine Python SDK / gcloud-sdk 中的某些证书已过期 2017-01-01。

作为临时解决方法，您可以将 <your-cloud-sdk-path>/platform/google_appengine/lib/cacerts/urlfetch_cacerts.txt 的内容替换为 https://curl.haxx.se/ca/cacert.pem

Answer 2

最近在 2017 年 8 月在本地开发环境中遇到此错误。解决方法是更新所有 urlfetch 调用并强制验证证书：

urlfetch.fetch(url=url, validate_certificate=True)

不必接触 gcloud 证书 (MacOS)。参见 Issuing an HTTPS request。

Answer 3

以@danielx 对 macOS 用户的回答为基础，这对我有用。我的证书路径是：

/Applications/GoogleAppEngineLauncher.app/Contents/Resources/GoogleAppEngine-default.bundle/Contents/Resources/google_appengine/lib/cacerts/urlfetch_cacerts.txt

为了更新它，我使用了以下步骤：

cd /Applications/GoogleAppEngineLauncher.app/Contents/Resources/GoogleAppEngine-default.bundle/Contents/Resources/google_appengine/lib/cacerts
mv urlfetch_cacerts.txt urlfetch_cacerts.bup
curl -o urlfetch_cacerts.txt -k https://curl.haxx.se/ca/cacert.pem

如果您没有安装 curl，您可以手动 download 证书并将它们移动到上面的文件夹中。如果已经运行.

，请不要忘记重新启动 App Engine 开发服务器

调用 apiclient.discovery.build 时 URL 的 SSL 证书无效 and/or

Invalid and/or missing SSL certificate for URL when calling apiclient.discovery.build

python

google-app-engine

ssl

google-api-python-client