google cloud python sdk installation error - SSL Certification Error

1
votes

Trying to install Google Cloud SDK(Python) on Windows 10 for All Users. Getting the following error.

This is new machine and start building fresh. Installed python 2.7 version prior to this.

Please help me to resolve this.

Output folder: C:\Program Files (x86)\Google\Cloud SDK Downloading Google Cloud SDK core. Extracting Google Cloud SDK core. Create Google Cloud SDK bat file: C:\Program Files (x86)\Google\Cloud SDK\cloud_env.bat Installing components. Welcome to the Google Cloud SDK! This will install all the core command line tools necessary for working with the Google Cloud Platform. Traceback (most recent call last): File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\bin\bootstrapping\install.py", line 214, in main() File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\bin\bootstrapping\install.py", line 192, in main Install(pargs.override_components, pargs.additional_components) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\bin\bootstrapping\install.py", line 134, in Install InstallOrUpdateComponents(to_install, update=update) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\bin\bootstrapping\install.py", line 177, in InstallOrUpdateComponents ['--quiet', 'components', verb, '--allow-no-backup'] + component_ids) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\calliope\cli.py", line 813, in Execute self._HandleAllErrors(exc, command_path_string, specified_arg_names) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\calliope\cli.py", line 787, in Execute resources = args.calliope_command.Run(cli=self, args=args) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\calliope\backend.py", line 754, in Run resources = command_instance.Run(args) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\surface\components\update.py", line 99, in Run version=args.version) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\core\updater\update_manager.py", line 850, in Update command_path='components.update') File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\core\updater\update_manager.py", line 591, in _GetStateAndDiff command_path=command_path) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\core\updater\update_manager.py", line 574, in _GetLatestSnapshot *effective_url.split(','), command_path=command_path) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\core\updater\snapshots.py", line 165, in FromURLs for url in urls] File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\core\updater\snapshots.py", line 186, in _DictFromURL response = installers.ComponentInstaller.MakeRequest(url, command_path) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\core\updater\installers.py", line 285, in MakeRequest return ComponentInstaller._RawRequest(req, timeout=timeout) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\core\updater\installers.py", line 329, in _RawRequest should_retry_if=RetryIf, sleep_ms=500) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\core\util\retry.py", line 155, in TryFunc return func(*args, kwargs), None File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\core\url_opener.py", line 73, in urlopen return opener.open(req, data, timeout) File "c:\users\cpa8161\appdata\local\temp\tmpxcdivh\python\lib\urllib2.py", line 429, in open response = self._open(req, data) File "c:\users\cpa8161\appdata\local\temp\tmpxcdivh\python\lib\urllib2.py", line 447, in _open '_open', req) File "c:\users\cpa8161\appdata\local\temp\tmpxcdivh\python\lib\urllib2.py", line 407, in _call_chain result = func(*args) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\core\url_opener.py", line 58, in https_open return self.do_open(build, req) File "c:\users\cpa8161\appdata\local\temp\tmpxcdivh\python\lib\urllib2.py", line 1195, in do_open h.request(req.get_method(), req.get_selector(), req.data, headers) File "c:\users\cpa8161\appdata\local\temp\tmpxcdivh\python\lib\httplib.py", line 1042, in request self._send_request(method, url, body, headers) File "c:\users\cpa8161\appdata\local\temp\tmpxcdivh\python\lib\httplib.py", line 1082, in _send_request self.endheaders(body) File "c:\users\cpa8161\appdata\local\temp\tmpxcdivh\python\lib\httplib.py", line 1038, in endheaders self._send_output(message_body) File "c:\users\cpa8161\appdata\local\temp\tmpxcdivh\python\lib\httplib.py", line 882, in _send_output self.send(msg) File "c:\users\cpa8161\appdata\local\temp\tmpxcdivh\python\lib\httplib.py", line 844, in send self.connect() File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\third_party\httplib2__init__.py", line 1081, in connect raise SSLHandshakeError(e) **httplib2.SSLHandshakeError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661) Failed to install.

6
google-cloud-platformgoogle-cloud-sdkgoogle-cloud-python

6 Answers

5
votes

Are you executing the command 'gcloud init' ? If you are facing this issue while installing then that is different. I directly downloaded the gcloud archive and unzipped it instead of using the installer which needed extra permissions behind my proxy.

I am behind a corporate proxy. I got the following error when I execute that command 

Rechecking network connection...done.
ERROR: Reachability Check still does not pass.
Cannot reach https://www.google.com (SSLHandshakeError)
Cannot reach https://accounts.google.com (SSLHandshakeError)

I followed this procedure. This might help you too.

  1. Export your organization's trusted root certificate.

enter image description here

  1. Open this certificate with Notepad.

  2. Append the contents to 

     \Google\Cloud SDK\google-cloud-sdk-201.0.0-windows-x86_64\google-cloud-sdk\lib\third_party\httplib2\python2\httplib2

    Note the path to the version of Python my Gcloud uses which is 2.x

1
votes

Need to add the below certificate in ..\google-cloud-sdk\lib\third_party\httplib2\cacerts.txt file. Then run install.bat once again

----BEGIN CERTIFICATE-----\nMIIDJjCCAg6gAwIBAgIIYkBXvgY381UwDQYJKoZIhvcNAQEFBQAwNjE0MDIGA1UE\nAxMrZmVkZXJhdGVkLXNpZ25vbi5zeXN0ZW0uZ3NlcnZpY2VhY2NvdW50LmNvbTAe\nFw0xNzEwMTkxMTQzMzRaFw0xNzEwMjIxMjEzMzRaMDYxNDAyBgNVBAMTK2ZlZGVy\nYXRlZC1zaWdub24uc3lzdGVtLmdzZXJ2aWNlYWNjb3VudC5jb20wggEiMA0GCSqG\nSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC1XYAow1e/aghfiZY7H2DFJIQ61okNrUfo\n3tdNPtxT1Rr2QyA0Zv/lZ3/Z/Daux/Sb1gvLXBuvLkzVYpu8EHmiMvATK7MD+ZXv\nZTeREh2UB4grlcLq4mc9uTkiARNAhBrEBrYwMeFPQlfc7zB5kiRAZHMhijah/CRg\nw8eVPn09xIJhfsytkFeHoVIz7EV1pD4VNqGZD+P80GEAgVfjh++leqOvCso4CP1G\nYtaOpzPfI03XcH1y0+b+sLTXduOitEyEji5h7aHe2nxbY8JRodsZ8kK1i1W8LpFN\nH+wZwHh/De5Zwoz3HE5EXDgYyaxT26ehqHbPaW4lkKgGDpx6oco5AgMBAAGjODA2\nMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBYGA1UdJQEB/wQMMAoGCCsG\nAQUFBwMCMA0GCSqGSIb3DQEBBQUAA4IBAQANVlLefEJ9qYboQKBq5ADjftFGWTl8\nhshV+dExMSj+dnXwScdvQcfUrqpxYZWtRP7290FjGHq54AtrPeQrYxffWXkb6OaQ\nel9ZX4IEViJbmCrc52ePxMRnEInrWCV8zZVoej5W63dxGf2x4bVF3o+95hD6Q5l/\nLt59MpY3J88S1x0YbNzYI7PgTBzzyR/o96ULvsKr3o5UmPGim3So4WUEEjtyFACG\nEFXtvc+LtCa9pQcEAcfNnAMl4gXtGVJt/A41JPwMsQtrcBVhpIKgU6bydw+wU9AJ\na6OWmXN360ELmRmDAR1dxZwpPN7YerWG/MbKuMtfO7OM2F9vG95/ve4x\n-----END CERTIFICATE-----
----BEGIN CERTIFICATE-----\nMIIDJjCCAg6gAwIBAgIIYf5bBvkimRwwDQYJKoZIhvcNAQEFBQAwNjE0MDIGA1UE\nAxMrZmVkZXJhdGVkLXNpZ25vbi5zeXN0ZW0uZ3NlcnZpY2VhY2NvdW50LmNvbTAe\nFw0xNzEwMjAxMTQzMzRaFw0xNzEwMjMxMjEzMzRaMDYxNDAyBgNVBAMTK2ZlZGVy\nYXRlZC1zaWdub24uc3lzdGVtLmdzZXJ2aWNlYWNjb3VudC5jb20wggEiMA0GCSqG\nSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsf1Gm4Sl491iKCsPXa/NQOJvigRF1mb8A\nBnUrnlW/MKgNaYFxPXaJn+7LrvkcsGX6R6h+u2pKHWGBFMQ9TCMmgE29VatoLkd/\nKKcXpoaYhMtjtoZu49HU5+pvew9YanLu5B2mfYOMkBFh86Pegqng2PsKf1Nj8q3g\nnCKfHCQzbYPjne1186RCAao7pOeyFS1boKKZn9ERue9R9ae20R7WcgZZnQmsIHNW\n87ssD9obyux5QAIo2uyZ5YksR6wKkxweFyI7BKy4SMTtgjSvlATw09GSvYEiFuLI\nSwTwr0m3IeM5MczrGkm45GLIXIrhY/24iMqUko4IMKdIB4PZhwu9AgMBAAGjODA2\nMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBYGA1UdJQEB/wQMMAoGCCsG\nAQUFBwMCMA0GCSqGSIb3DQEBBQUAA4IBAQBV5iX6VGpeUT6ghhDNHFxPQc8G4PR7\ntnSP5p+aK9ieGwaoTDreH9LnypiKBJXP0KPwMfn4G56mu2pNiLjvSCibRTuHS6vN\nOjWDUwADt8VRAWfS+3LaUp3aPpQHbk+UcYXZ/HkpyMpjJnvD32+yEHuGzyK+14+B\nEtTJ+AM0mkldm4f1mrL8/SiWMUuPUGVhaeZXqA0A0Ra4XSL8cBWcj+89lYhN2zcF\nyLPYk3/CyKmq4fu+HrgtP07XiD3OwDOT7cZjMD64EhO5Pxjp1EqDsWllbTN/nCRg\nMmmUjUC5X8JptibPxVJm8QtCUBYLXq9sHhMgkcyZ9oSj6PwD4a4wBMk7\n-----END CERTIFICATE-----
----BEGIN CERTIFICATE-----\nMIIDJjCCAg6gAwIBAgIIVaa5+0yJ3V8wDQYJKoZIhvcNAQEFBQAwNjE0MDIGA1UE\nAxMrZmVkZXJhdGVkLXNpZ25vbi5zeXN0ZW0uZ3NlcnZpY2VhY2NvdW50LmNvbTAe\nFw0xNzEwMTgxMTQzMzRaFw0xNzEwMjExMjEzMzRaMDYxNDAyBgNVBAMTK2ZlZGVy\nYXRlZC1zaWdub24uc3lzdGVtLmdzZXJ2aWNlYWNjb3VudC5jb20wggEiMA0GCSqG\nSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZSCXl2+w/3ORI3Kp3n5RxTdweNRjo9xth\nwlw4wWC7t782Cw5xzN/FQTgQOHqiSbx6oOJAkU/vXbkcWsE9NprdakDJi2W+9KTv\nMHAj9WzaSMuarfi0g/SCR1bWzQI1h8a52lBBNL+TOg+KFKKQtu7am/m6SW9COfJj\nie8u+ol5FyzjQ5qd2VocmNGgCGD/HhydeU5/9JIhGkHf4fIA4QTTsASqjwB+V7df\nZWel6qJiFpuDZNifz8S8JCwpZhBtoIJDidr32SyprH0k+tpN+7C5HJunGIaxinSb\nTdYKlMLUTVlOVi3h1Gxb6b5wSQkCPzaEgJXoWO2qRnlu0f51SVAxAgMBAAGjODA2\nMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBYGA1UdJQEB/wQMMAoGCCsG\nAQUFBwMCMA0GCSqGSIb3DQEBBQUAA4IBAQB1D8297ANfncXclhPjm3Cw9+5AGsPX\n5OCF/RKPIJDainsOSMwhiY8fNIEaENMp82N7/16woWoD87UDOxbm2Z5Rfe3sQatv\nL002NXs1y19U7QuhC25cxcgUC0ESxdXnmBHoLJo8ou73GNj4UJEppNWzXxaXCXtC\ncLZWPMsSBG0M9WY9/UQ2P3273SajkSKMNrAwZFzUXvuwDreKHS89Qc44/JaFCCCS\nwe+lXMhRfWNeBCgS+xZGKe8dUjHrGD9c3RrKbDRDZ3XuQXZgd5VfL/GgjJTcDAXA\nw1zzXQWX4Y6DcU+YXuCVVdOFtBC5qrhzLsiJxhFu+LTyJxLGihQuMytu\n-----END CERTIFICATE-----
1
votes

This error has been reported on Google's Issue Tracker.

This issue is caused by being behind a corporate proxy. At this time the proposed workaround, detailed here, is to append the corporate certificate to google-cloud-sdk/lib/third_party/httplib2/cacerts.txt

1
votes

I just spent hours trying to make the installer run trying to edit ca cert files but the installer keeps wiping the directories as part of the installation process. In order to make the bundle gcloud sdk installer work, I ended up having to create an environment variable SSL_CERT_FILE and setting the path to a ca cert text file that contained the Google CAs + my company's proxy CA cert. Then the installer ran without issue. It seems that env variable is used by the python http client for CA validation.

Then you need to run gcloud config set custom_ca_certs_file before running gcloud init

0
votes

Every time the installer wiping the directories, so you can’t install via UI.

So run installer batch file after updating organization RootCA on file: 

C:\Users\<username>\AppData\Local\Google\Cloud SDK\google-cloud-sdk\lib\third_party\certifi\ cacert.pem
0
votes

I found that in addition to the above environment variable, you also need to preconfigure the gcloud sdk by creating the config files. I wrote a PS script to do it. I have used it on several computers with success.

# path to roots bundle
$rootsBundle = "full path to roots bundle"

# check if $env:appdata\gcloud\configurations exist. This indicates the gcloud is already initialized
# if not, create it
if (!(Test-Path "$env:APPDATA\gcloud\configurations\config_default")){

    # create configurations directory
    New-Item "$env:APPDATA\gcloud\configurations" -ItemType "directory" -Force

    # write ssl config to core config
    "[core]`r`ncustom_ca_certs_file = $rootsBundle" | Out-File -FilePath "$env:APPDATA\gcloud\configurations\config_default" -Encoding ASCII -NoNewline

    # set config to default config
    "default" | Out-File -FilePath "$env:APPDATA\gcloud\active_config" -Encoding ASCII -NoNewline
}
else {
    Write-Host "GCloud config already detected. We will assume you already configured the CA bundle"
}

# download and start gcloud sdk installer
(New-Object Net.WebClient).DownloadFile("https://dl.google.com/dl/cloudsdk/channels/rapid/GoogleCloudSDKInstaller.exe", "$env:Temp\GoogleCloudSDKInstaller.exe")

& $env:Temp\GoogleCloudSDKInstaller.exe