[conan.io/center] SSL certificate is invalid

[AJIOB]

Hello. I'm trying to pull packages from Conan center (boost, qt and so on) and receive that error from conan:

ERROR: HTTPSConnectionPool(host='conan.bintray.com', port=443): Max retries exceeded with url: /v1/ping (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:645)'),))

Unable to connect to conan-center=https://conan.bintray.com
1. Make sure the remote is reachable or,
2. Disable it by using conan remote disable,
Then try again.

My remotes:

$ conan remote list
conan-center: https://conan.bintray.com [Verify SSL: True]
gitlab: https://gitlab.example.com/api/v4/packages/conan [Verify SSL: True]

I'm using OS Ubuntu 16.04 LTS x64 with conan 1.35.0, installed from pip3.

It looks like conan center server problem. I'm looking for certificate, but it looks like self-signed:

DNS record looks like correct:

$ ping conan.bintray.com
PING conan.bintray.com (34.120.178.43) 56(84) bytes of data.
64 bytes from 43.178.120.34.bc.googleusercontent.com (34.120.178.43): icmp_seq=1 ttl=250 time=23.3 ms
64 bytes from 43.178.120.34.bc.googleusercontent.com (34.120.178.43): icmp_seq=2 ttl=250 time=22.7 ms
64 bytes from 43.178.120.34.bc.googleusercontent.com (34.120.178.43): icmp_seq=3 ttl=250 time=22.7 ms
^C
--- conan.bintray.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2001ms
rtt min/avg/max/mdev = 22.771/22.961/23.336/0.292 ms

How can I download packages from conan center?

[Bigpet]

This does not appear to be an SSL issue specifically.

If you disable SSL verification (conan remote remove conan-center and then conan remote add conan-center https://conan.bintray.com False) it'll fail with ERROR: Exceeded 30 redirects.. [Remote: conan-center]

It seems like GET | https://conan.bintray.com/ is responded with 301 location: https://conan.bintray.com/, so a circular redirect

[saukijan]

@Bigpet, same for me. it seems that conan.bintray itself is down see downforeveryoneorjustme.

Could this be related to Service end for Bintray?

[saukijan]

this is a service brownout caused by the migration, see conan blog Bintray Sunset, the service will be down between 6 AM and 2PM (UTC0 I assume), see bintray status.

Guess there is no other solution, but to be patient for now.

[Bigpet]

@saukijan there's some more details here: conan-io/conan#8788

Apparently the course of action is to wait. Would be nice if the satus page would display maintainance-based outages more clearly than a note below a green status

[Vhab]

this is a service brownout caused by the migration, see conan blog Bintray Sunset, the service will be down between 6 AM and 2PM (UTC0 I assume), see bintray status.

Guess there is no other solution, but to be patient for now.

But this doesn't really make sense. Why would they take down the service that isn't being sunset to warn people about sunsetting the other services.
This is just intentionally disrupting users of a service they intend to continue to support.

[jhamfler]

The jfrog docs say that ConanCenter will be the "new bintray", but where is the URL whe need to replace https://conan.bintray.com with? The docs also say that ConanCenter will not be affected so the URL conan.bintray.com is not the right new one I suppose because otherwise it wouldn't have a downtime.

[saukijan]

this is a service brownout caused by the migration, see conan blog Bintray Sunset, the service will be down between 6 AM and 2PM (UTC0 I assume), see bintray status.
Guess there is no other solution, but to be patient for now.

But this doesn't really make sense. Why would they take down the service that isn't being sunset to warn people about sunsetting the other services.
This is just intentionally disrupting users of a service they intend to continue to support.

Well as I understand the article, the bintray service (where conan-center packages are hosted) is being sunset so it makes sense, however it could have been handled with a bit more forewarn for the users. I had to dig quite a bit to get that info.

[saukijan]

The jfrog docs say that ConanCenter will be the "new bintray", but where is the URL whe need to replace https://conan.bintray.com with? The docs also say that ConanCenter will not be affected so the URL conan.bintray.com is not the right new one I suppose because otherwise it wouldn't have a downtime.

as stated in conan#8788, there will be no need to change the URL, it will be automatically redirected.

For now let's wait and see.

[Vhab]

this is a service brownout caused by the migration, see conan blog Bintray Sunset, the service will be down between 6 AM and 2PM (UTC0 I assume), see bintray status.
Guess there is no other solution, but to be patient for now.

But this doesn't really make sense. Why would they take down the service that isn't being sunset to warn people about sunsetting the other services.
This is just intentionally disrupting users of a service they intend to continue to support.

Well as I understand the article, the bintray service (where conan-center packages are hosted) is being sunset so it makes sense, however it could have been handled with a bit more forewarn for the users. I had to dig quite a bit to get that info.

It also lists:

Bintray services will no longer be available. GoCenter, and ChartCenter services will no longer be available to non-Artifactory clients. (ConanCenter is not affected).

It's a shame the appropriate redirect has not been setup prior to this scheduled brown-out.

But nothing to do right now but wait it out.

[saukijan]

seems to be resolved now

[AJIOB]

seems to be resolved now

I can reproduce an issue now (with 30 redirects error)

[madebr]

At the end of this month, boost sources will be moved to a different location.
See https://lists.boost.org/boost-users/2021/04/90883.php

e.g. https://dl.bintray.com/boostorg/release/1.74.0/source/boost_1_74_0.tar.gz becomes https://boostorg.jfrog.io/artifactory/main/release/1.74.0/source/boost_1_74_0.tar.gz

So somebody should apply the regex s#dl.bintray.com/boostorg#boostorg.jfrog.io/artifactory/main#g to the boost recipe, and open a pr with this change.

[jgsogo]

Things should be back to normal now (as they were before the brownout). Bintray sunset is over. We have faced two different issues related to conan.bintray.com that were not expected 😞 . We will work on them and hopefully next brownout on 26th April should not affect the Conan ecosystem.

Thanks for your patience.

[AJIOB]

My builds are working again. Thanks. I'm closing the issue.

[cqc-alec]

Something similar seems to be happening now with center.conan.io:

ERROR: HTTPSConnectionPool(host='center.conan.io', port=443): Max retries exceeded with url: /v1/ping (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1131)')))

Unable to connect to conan-center=https://center.conan.io
1. Make sure the remote is reachable or,
2. Disable it by using conan remote disable,
Then try again.

[AJIOB]

Something similar seems to be happening now with center.conan.io:

ERROR: HTTPSConnectionPool(host='center.conan.io', port=443): Max retries exceeded with url: /v1/ping (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1131)')))

Unable to connect to conan-center=https://center.conan.io
1. Make sure the remote is reachable or,
2. Disable it by using conan remote disable,
Then try again.

Our C/C++ developers detect this too with our internal gitlab-embedded Conan server.

Looks like this is either Conan backend issue or Conan breaks connection for all servers if one have invalid certificate.

P.S. Gitlab-embedded conan server answers with correct certificate (was checked with browser on URL https://gitlab.example.com/api/v4/packages/conan/v1/ping
P.P.S. The issue was tested on Conan 1.39.0 & 1.40.2 (latest available in pip)

$ conan remote list
conancenter: https://center.conan.io [Verify SSL: True]
conan-center: https://conan.bintray.com [Verify SSL: True, Disabled: True]
gitlab: https://gitlab.example.com/api/v4/packages/conan [Verify SSL: True]

[AJIOB]

Looks like my problem affected by LetsEncrypt Root certificate expiration:
https://scotthelme.co.uk/lets-encrypt-old-root-expiration/

Any solutions/support for cross-signing?

P.S. It may be the problem of python embedded OpenSSL: OpenSSL <= 1.0.2 is not supported by Let's Encrypt after 30 Sep 2021

[ohanar]

@AJIOB See conan-io/conan#9695 (comment)

[AJIOB]

@ohanar Thanks, upgrading to 1.40.3 was helped