Open jmilloy opened 3 years ago
@mpu-creare I pulled this out to its own issue.
The correct solution is to set CURL_CA_BUNDLE
on some systems. I see two options.
podpac raises a better exception. On RasterioIOError
, check for the existence of the file using s3fs and if it exists, raise an exception that suggest setting CURL_CA_BUNDLE
.
podpac sets CURL_CA_BUNDLE
when necessary. On my system, you can use curl-config --ca
to get the correct path, so I think we could do this automatically. We could probably do this on any linux system without adverse affect, and include a trait to disable setting it, for informed users doing something special in rare situations.
Rasterio obviously has chosen to document and otherwise punt on this issue, but I think very few people are going to be able to figure out that exception and the required fix.
At least 1 should help.
For 2, you could see if 'CURL_CA_BUNDLE' is already in the environmental vriables, and if not try the curl-config --ca
trick.
Description Rasterio fails to open s3 paths on some systems due to missing SSL certificates. The exception is completely misleading
According to https://github.com/mapbox/rasterio/commit/b621d92c51f7c2021f89cd4487cecdd7c201f320, libcurl on linux expects the ssl certificates to be at the CentOS default
/etc/pki/tls/certs/ca-bundle.crt
, but on other systems they will be at other locations.Steps to Reproduce
On an Ubuntu system:
You can produce the error without podpac as well:
Observed Behavior
Additional Notes
Currently, podpac (and rasterio) have a sort of workaround that uses HTTP instead of HTTPS:
which translates to