SSLHandshakeError

[daviddavo]

Using raspbian 8.0 jessie (armv7). It has been working for a few days but then it started giving me I/O errors, so I umounted, and when I tried to mount again, it raised this error:

$ sudo gdfs -o allow_other /home/pi/gdfs.creds /mnt/gdrivefs
Traceback (most recent call last):
  File "/usr/local/bin/gdfs", line 47, in <module>
    main()
  File "/usr/local/bin/gdfs", line 44, in main
    option_string=option_string)
  File "/usr/local/lib/python2.7/dist-packages/gdrivefs/gdfs/gdfuse.py", line 863, in mount
    gdrivefs.gdtool.account_info.AccountInfo().get_data()
  File "/usr/local/lib/python2.7/dist-packages/gdrivefs/gdtool/account_info.py", line 19, in get_data
    return gd.get_about_info()
  File "/usr/local/lib/python2.7/dist-packages/gdrivefs/gdtool/drive.py", line 56, in wrapper
    return f(*args, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/gdrivefs/gdtool/drive.py", line 190, in get_about_info
    client = self.__auth.get_client()
  File "/usr/local/lib/python2.7/dist-packages/gdrivefs/gdtool/drive.py", line 152, in get_client
    discoveryServiceUrl=discoveryUrl)
  File "/usr/local/lib/python2.7/dist-packages/oauth2client/util.py", line 132, in positional_wrapper
    return wrapped(*args, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/apiclient/discovery.py", line 192, in build
    resp, content = http.request(requested_url)
  File "/usr/local/lib/python2.7/dist-packages/oauth2client/util.py", line 132, in positional_wrapper
    return wrapped(*args, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/oauth2client/client.py", line 490, in new_request
    redirections, connection_type)
  File "/usr/local/lib/python2.7/dist-packages/httplib2/__init__.py", line 1570, in request
    (response, content) = self._request(conn, authority, uri, request_uri, method, body, headers, redirections, cachekey)
  File "/usr/local/lib/python2.7/dist-packages/httplib2/__init__.py", line 1317, in _request
    (response, content) = self._conn_request(conn, request_uri, method, body, headers)
  File "/usr/local/lib/python2.7/dist-packages/httplib2/__init__.py", line 1252, in _conn_request
    conn.connect()
  File "/usr/local/lib/python2.7/dist-packages/httplib2/__init__.py", line 1044, in connect
    raise SSLHandshakeError(e)
httplib2.SSLHandshakeError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)

[dsoprea]

The certificate is owned by the server and authenticated against your system. It could break because of the server or break because your system won't recognize its authority, but not because of anything this application does from one minute to the next. Just try it again. It's probably network-related.

[daviddavo]

I don't think it's system related because It was working fine a few days ago. So the certificates should be the same. I'll check if it's a network related problem. Btw, Is there any way to disable verification checking?

[blitz313]

yeah, seconding this issue - noticed the problem this morning when my backup failed b/c the drive wasn't mounted. I'm receiving the same exact error.

[dsoprea]

That's not the right solution. There's something else going on. Certificates don't just work one day and not work the next. I'm inclined to think that the server is the culprit. However, since Google's certificates are unlikely to be expired, it might be that we're/you're using and old version of the Google Python API Client, which maybe has deprecated servers.

I went to get the hostname out of the client files so that I could look at the certificate on their server, but your stacktrace has a different directory structure than I expected to see. The same files are not present. This is not to say that the functionality doesn't existing somewhere but that you're running with different tools and you also happen to be having trouble. When I created a fresh virtualenv and installed the project, I did searches for these two files of the client/oauth packages from your stacktrace:

(gdrivefs) $ find ./ -name discovery.py
./python2.7/site-packages/googleapiclient/discovery.py
(gdrivefs) $ find ./ -name util.py
./python2.7/site-packages/wheel/util.py
./python2.7/site-packages/rsa/util.py
./python2.7/site-packages/pip/_vendor/distlib/util.py

So, it might just be a deprecation issue having to do with old versions of the packages that you both happen to have.

Do me a favor and either completely uninstall of the GDriveFS dependencies or just simply create a new virtualenv, install into it, and try again. Let's see.

[daviddavo]

I re-installed google-api-python-client but It keeps failing

I searched about httplib2 and it seems that it has its own CA's, so, are you using httplib's CAs or systemwide CA's?

[dsoprea]

Well, connection-semantics are outside of the scope of this project. How and where to connect is a concern of that project (and oauth), but not this one. I can't specifically say where the CA-bundle is global to the system or embedded in the project. The symptoms don't seem to favor one or the other. This is definitely not a server issue since it's not affecting everyone. I can still connect. The immediate system is Ubuntu 14.04 .

I will say that the Google server has a really weird certificate right now. Where most certificates of such well known servers are going to be five or ten years, with one year being the minimum, this API's certificate is currently good for only three months:

It was likely changed within the last three weeks. I can't speak to the state of your CA bundle and I can't say when their last certificate expired, but if this was somehow cached in your system, then that would be one of the reasons that certificate verification would start failing within that period of time.

[blitz313]

I'll try a fresh install of GDriveFS tonight and see if that clears things up. I suspected it might be that something on my system is out-of-date as I think the auth instructions have even changed from when I first set this rig up. Will let you guys know the results later - thanks for the analysis.

[dsoprea]

There's now a default file for the auth. There's also a streamlined authentication process called auto-auth that'll automatically over the browser and then write Google's auth response to your credentials. That's it. They're both optional and backwards compatible. Nothing in this project would cause a protocol breakdown.

Let me know how it looks.

On Mon, Mar 5, 2018, 15:58 blitz313 notifications@github.com wrote:

I'll try a fresh install of GDriveFS tonight and see if that clears things up. I suspected it might be that something on my system is out-of-date as I think the auth instructions have even changed from when I first set this rig up. Will let you guys know the results later - thanks for the analysis.

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/dsoprea/GDriveFS/issues/195#issuecomment-370562914, or mute the thread https://github.com/notifications/unsubscribe-auth/AArranMPGESbuTVlF-imYnPPvTEgP9YVks5tbabYgaJpZM4SbFCu .

[blitz313]

so, i tried re-installing gdrivefs - but whenever I try the steps for auth i get the following...

[***]# gdfstool auth_automatic usage: gdfstool [-h] {auth,mount} ... gdfstool: error: argument command: invalid choice: 'auth_automatic' (choose from 'auth', 'mount')

so, I have the feeling that uninstall/re-installing still isn't updating something properly since the arguments don't seem to match up with what is expected. Any thoughts on how to do a clean install? should I clean out the /usr/local/bin/gdfs or something of that nature? Sorry, not that familiar with pip installations - so apologies if this is a noob question.

[blitz313]

Ok, got it - the problem is the httplib2 dependency... according the requirement.txt, minimum required version is: httplib2>=0.9.2 However, when doing a pip install of gdrivefs, you get the following result....

[***************]# pip install gdrivefs
Requirement already satisfied: gdrivefs in /usr/local/lib/python2.7/site-packages
Requirement already satisfied: six==1.7.3 in /usr/local/lib/python2.7/site-packages (from gdrivefs)
Collecting httplib2==0.8 (from gdrivefs)
Requirement already satisfied: google-api-python-client==1.2 in /usr/local/lib/python2.7/site-packages (from gdrivefs)
Requirement already satisfied: gipc==0.4.0 in /usr/local/lib/python2.7/site-packages (from gdrivefs)
Requirement already satisfied: greenlet==0.4.2 in /usr/local/lib/python2.7/site-packages (from gdrivefs)
Requirement already satisfied: fusepy==2.0.2 in /usr/local/lib/python2.7/site-packages (from gdrivefs)
Requirement already satisfied: gevent==1.0 in /usr/local/lib/python2.7/site-packages (from gdrivefs)
Requirement already satisfied: python-dateutil==2.2 in /usr/local/lib/python2.7/site-packages (from gdrivefs)
**Installing collected packages: httplib2
  Found existing installation: httplib2 0.10.3
    Uninstalling httplib2-0.10.3:
      Successfully uninstalled httplib2-0.10.3
Successfully installed httplib2-0.8**

If after the GDriveFS installation subsequently, uninstall httplib2 and reinstall with the latest version (httplib2-0.10.3) - then authentication works successfully and the drive mounts properly.

Now, however - I still don't see the latest gdrivefs options for the automatic auth, so something tells me that even after I uninstall/re-install - that something is still lingering possibly from an old version, even though pip says it's updated....

[*************]# gdfstool auth_automatic
usage: gdfstool [-h] {auth,mount} ...
gdfstool: error: argument command: invalid choice: 'auth_automatic' (choose from 'auth', 'mount')
[*************]# pip show gdrivefs
Name: gdrivefs
**Version: 0.14.9**
Summary: A complete FUSE adapter for Google Drive.
Home-page: https://github.com/dsoprea/GDriveFS
Author: Dustin Oprea
Author-email: myselfasunder@gmail.com
License: GPL 2
Location: /usr/local/lib/python2.7/site-packages
Requires: six, httplib2, google-api-python-client, gipc, greenlet, fusepy, gevent, python-dateutil

so, something is still fishy there, but this issue can be resolved with the following and making sure the httplib2 version matches or is greater than the required 0.9.2

[*************]# pip uninstall httplib2
Uninstalling httplib2-0.8:
  /usr/local/lib/python2.7/site-packages/httplib2-0.8.dist-info/DESCRIPTION.rst
  /usr/local/lib/python2.7/site-packages/httplib2-0.8.dist-info/INSTALLER
  /usr/local/lib/python2.7/site-packages/httplib2-0.8.dist-info/METADATA
  /usr/local/lib/python2.7/site-packages/httplib2-0.8.dist-info/RECORD
  /usr/local/lib/python2.7/site-packages/httplib2-0.8.dist-info/WHEEL
  /usr/local/lib/python2.7/site-packages/httplib2-0.8.dist-info/metadata.json
  /usr/local/lib/python2.7/site-packages/httplib2-0.8.dist-info/top_level.txt
  /usr/local/lib/python2.7/site-packages/httplib2/__init__.py
  /usr/local/lib/python2.7/site-packages/httplib2/__init__.pyc
  /usr/local/lib/python2.7/site-packages/httplib2/cacerts.txt
  /usr/local/lib/python2.7/site-packages/httplib2/iri2uri.py
  /usr/local/lib/python2.7/site-packages/httplib2/iri2uri.pyc
  /usr/local/lib/python2.7/site-packages/httplib2/socks.py
  /usr/local/lib/python2.7/site-packages/httplib2/socks.pyc
Proceed (y/n)? y
  Successfully uninstalled httplib2-0.8
[*************]# pip install httplib2
Collecting httplib2
Installing collected packages: httplib2
Successfully installed httplib2-0.10.3

[deng47]

I think I am experiencing the same issue. I installed gdrivefs on my google compute engine(centos7) around 2 months ago. It worked perfectly until this week. I tried reinstalling httplib as blitz313 said, but it still doesn't work. The following are my output.

[root@myvm ~]# pip uninstall httplib2
Uninstalling httplib2-0.10.3:
  /usr/lib/python3.4/site-packages/httplib2-0.10.3-py3.4.egg-info
  /usr/lib/python3.4/site-packages/httplib2/__init__.py
  /usr/lib/python3.4/site-packages/httplib2/__pycache__/__init__.cpython-34.pyc
  /usr/lib/python3.4/site-packages/httplib2/__pycache__/iri2uri.cpython-34.pyc
  /usr/lib/python3.4/site-packages/httplib2/cacerts.txt
  /usr/lib/python3.4/site-packages/httplib2/iri2uri.py
Proceed (y/n)? y
  Successfully uninstalled httplib2-0.10.3
[root@myvm ~]# pip install httplib2
Collecting httplib2
  Using cached httplib2-0.10.3.tar.gz
Installing collected packages: httplib2
  Running setup.py install for httplib2 ... done
Successfully installed httplib2-0.10.3
[root@myvm ~]# /bin/gdfs -o allow_other /var/cache/gdfs.creds /deng5
Traceback (most recent call last):
  File "/bin/gdfs", line 47, in <module>
    main()
  File "/bin/gdfs", line 44, in main
    option_string=option_string)
  File "/usr/lib/python2.7/site-packages/gdrivefs/gdfs/gdfuse.py", line 863, in mount
    gdrivefs.gdtool.account_info.AccountInfo().get_data()
  File "/usr/lib/python2.7/site-packages/gdrivefs/gdtool/account_info.py", line 19, in get_data
    return gd.get_about_info()
  File "/usr/lib/python2.7/site-packages/gdrivefs/gdtool/drive.py", line 56, in wrapper
    return f(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/gdrivefs/gdtool/drive.py", line 190, in get_about_info
    client = self.__auth.get_client()
  File "/usr/lib/python2.7/site-packages/gdrivefs/gdtool/drive.py", line 152, in get_client
    discoveryServiceUrl=discoveryUrl)
  File "/usr/lib/python2.7/site-packages/oauth2client/util.py", line 132, in positional_wrapper
    return wrapped(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/apiclient/discovery.py", line 192, in build
    resp, content = http.request(requested_url)
  File "/usr/lib/python2.7/site-packages/oauth2client/util.py", line 132, in positional_wrapper
    return wrapped(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/oauth2client/client.py", line 490, in new_request
    redirections, connection_type)
  File "/usr/lib/python2.7/site-packages/httplib2/__init__.py", line 1570, in request
    (response, content) = self._request(conn, authority, uri, request_uri, method, body, headers, redirections, cachekey)
  File "/usr/lib/python2.7/site-packages/httplib2/__init__.py", line 1317, in _request
    (response, content) = self._conn_request(conn, request_uri, method, body, headers)
  File "/usr/lib/python2.7/site-packages/httplib2/__init__.py", line 1252, in _conn_request
    conn.connect()
  File "/usr/lib/python2.7/site-packages/httplib2/__init__.py", line 1044, in connect
    raise SSLHandshakeError(e)
httplib2.SSLHandshakeError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)

[blitz313]

Try re-installing gdrivefs as well. I had been trying a lot of things, so it may have been a culmination of those that corrected the issue. Doing the re-install will also point out any other dependency issues.

[deng47]

I just created a brand new CentOS7 VM on google cloud and installed everything from scratch. But I still get the httplib2.SSLHandshakeError

@daviddavo mentioned auto-auth and a default file 3 days ago. I am not sure what it means and how to use them to fix my issue. Could you please explain more?

[deng47]

Finally fixed it. I updated google-api-python-client, and some other python libs. I guess it's a google-api-python-client issue.

[MurzNN]

@deng47 can you publish list of all libs and versions? I upgrade google-api-python-client from current git, and httplib2 have version 0.10.3, but still got same error.

[deng47]

I am not 100% sure which one fixed my issue, here are what I updated: python -m pip install --upgrade certifi python -m pip install --upgrade request python -m pip install --upgrade pyOpenSSL python -m pip install --upgrade google-api-python-client python -m pip install -I google-api-python-client

google-api-python-client (1.6.5) httplib2 (0.10.3) certifi (2018.1.18) pyOpenSSL (17.5.0) request (0.0.26)

[xiahuaijia]

[SSL: CERTIFICATE_VERIFY_FAILED] use this can fix it pip install oauth2client==2.2.0

[dsoprea]

It sounds like upgrading oauth2client was the general fix, and the dependencies, for some reason, were missing this entirely before. I'd fixed this a few days ago while investigating another issue.