google cloud python sdk installation error - SSL Certification Error

Question

Trying to install Google Cloud SDK(Python) on Windows 10 for All Users. Getting the following error.

This is new machine and start building fresh. Installed python 2.7 version prior to this.

Please help me to resolve this.

Output folder: C:\Program Files (x86)\Google\Cloud SDK Downloading Google Cloud SDK core. Extracting Google Cloud SDK core. Create Google Cloud SDK bat file: C:\Program Files (x86)\Google\Cloud SDK\cloud_env.bat Installing components. Welcome to the Google Cloud SDK! This will install all the core command line tools necessary for working with the Google Cloud Platform. Traceback (most recent call last): File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\bin\bootstrapping\install.py", line 214, in main() File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\bin\bootstrapping\install.py", line 192, in main Install(pargs.override_components, pargs.additional_components) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\bin\bootstrapping\install.py", line 134, in Install InstallOrUpdateComponents(to_install, update=update) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\bin\bootstrapping\install.py", line 177, in InstallOrUpdateComponents ['--quiet', 'components', verb, '--allow-no-backup'] + component_ids) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\calliope\cli.py", line 813, in Execute self._HandleAllErrors(exc, command_path_string, specified_arg_names) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\calliope\cli.py", line 787, in Execute resources = args.calliope_command.Run(cli=self, args=args) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\calliope\backend.py", line 754, in Run resources = command_instance.Run(args) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\surface\components\update.py", line 99, in Run version=args.version) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\core\updater\update_manager.py", line 850, in Update command_path='components.update') File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\core\updater\update_manager.py", line 591, in _GetStateAndDiff command_path=command_path) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\core\updater\update_manager.py", line 574, in _GetLatestSnapshot *effective_url.split(','), command_path=command_path) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\core\updater\snapshots.py", line 165, in FromURLs for url in urls] File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\core\updater\snapshots.py", line 186, in _DictFromURL response = installers.ComponentInstaller.MakeRequest(url, command_path) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\core\updater\installers.py", line 285, in MakeRequest return ComponentInstaller._RawRequest(req, timeout=timeout) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\core\updater\installers.py", line 329, in _RawRequest should_retry_if=RetryIf, sleep_ms=500) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\core\util\retry.py", line 155, in TryFunc return func(*args, kwargs), None File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\core\url_opener.py", line 73, in urlopen return opener.open(req, data, timeout) File "c:\users\cpa8161\appdata\local\temp\tmpxcdivh\python\lib\urllib2.py", line 429, in open response = self._open(req, data) File "c:\users\cpa8161\appdata\local\temp\tmpxcdivh\python\lib\urllib2.py", line 447, in _open '_open', req) File "c:\users\cpa8161\appdata\local\temp\tmpxcdivh\python\lib\urllib2.py", line 407, in _call_chain result = func(*args) File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\core\url_opener.py", line 58, in https_open return self.do_open(build, req) File "c:\users\cpa8161\appdata\local\temp\tmpxcdivh\python\lib\urllib2.py", line 1195, in do_open h.request(req.get_method(), req.get_selector(), req.data, headers) File "c:\users\cpa8161\appdata\local\temp\tmpxcdivh\python\lib\httplib.py", line 1042, in request self._send_request(method, url, body, headers) File "c:\users\cpa8161\appdata\local\temp\tmpxcdivh\python\lib\httplib.py", line 1082, in _send_request self.endheaders(body) File "c:\users\cpa8161\appdata\local\temp\tmpxcdivh\python\lib\httplib.py", line 1038, in endheaders self._send_output(message_body) File "c:\users\cpa8161\appdata\local\temp\tmpxcdivh\python\lib\httplib.py", line 882, in _send_output self.send(msg) File "c:\users\cpa8161\appdata\local\temp\tmpxcdivh\python\lib\httplib.py", line 844, in send self.connect() File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\third_party\httplib2__init__.py", line 1081, in connect raise SSLHandshakeError(e) **httplib2.SSLHandshakeError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661) Failed to install.

Answer 1

Are you executing the command 'gcloud init' ? If you are facing this issue while installing then that is different. I directly downloaded the gcloud archive and unzipped it instead of using the installer which needed extra permissions behind my proxy.

I am behind a corporate proxy. I got the following error when I execute that command

Rechecking network connection...done.
ERROR: Reachability Check still does not pass.
Cannot reach https://www.google.com (SSLHandshakeError)
Cannot reach https://accounts.google.com (SSLHandshakeError)

I followed this procedure. This might help you too.

1. Export your organization's trusted root certificate.

2. Open this certificate with Notepad.

3. Append the contents to

    \Google\Cloud SDK\google-cloud-sdk-201.0.0-windows-x86_64\google-cloud-sdk\lib\third_party\httplib2\python2\httplib2
   

   Note the path to the version of Python my Gcloud uses which is 2.x

Answer 2

This error has been reported on Google's Issue Tracker.

This issue is caused by being behind a corporate proxy. At this time the proposed workaround, detailed here, is to append the corporate certificate to google-cloud-sdk/lib/third_party/httplib2/cacerts.txt

Answer 3

I found that in addition to the above environment variable, you also need to preconfigure the gcloud sdk by creating the config files. I wrote a PS script to do it. I have used it on several computers with success.

# path to roots bundle
$rootsBundle = "full path to roots bundle"

# check if $env:appdata\gcloud\configurations exist. This indicates the gcloud is already initialized
# if not, create it
if (!(Test-Path "$env:APPDATA\gcloud\configurations\config_default")){

    # create configurations directory
    New-Item "$env:APPDATA\gcloud\configurations" -ItemType "directory" -Force

    # write ssl config to core config
    "[core]`r`ncustom_ca_certs_file = $rootsBundle" | Out-File -FilePath "$env:APPDATA\gcloud\configurations\config_default" -Encoding ASCII -NoNewline

    # set config to default config
    "default" | Out-File -FilePath "$env:APPDATA\gcloud\active_config" -Encoding ASCII -NoNewline
}
else {
    Write-Host "GCloud config already detected. We will assume you already configured the CA bundle"
}

# download and start gcloud sdk installer
(New-Object Net.WebClient).DownloadFile("https://dl.google.com/dl/cloudsdk/channels/rapid/GoogleCloudSDKInstaller.exe", "$env:Temp\GoogleCloudSDKInstaller.exe")

& $env:Temp\GoogleCloudSDKInstaller.exe

Answer 4

Need to add the below certificate in ..\google-cloud-sdk\lib\third_party\httplib2\cacerts.txt file. Then run install.bat once again

----BEGIN CERTIFICATE-----
MIIDJjCCAg6gAwIBAgIIYkBXvgY381UwDQYJKoZIhvcNAQEFBQAwNjE0MDIGA1UE
AxMrZmVkZXJhdGVkLXNpZ25vbi5zeXN0ZW0uZ3NlcnZpY2VhY2NvdW50LmNvbTAe
Fw0xNzEwMTkxMTQzMzRaFw0xNzEwMjIxMjEzMzRaMDYxNDAyBgNVBAMTK2ZlZGVy
YXRlZC1zaWdub24uc3lzdGVtLmdzZXJ2aWNlYWNjb3VudC5jb20wggEiMA0GCSqG
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQC1XYAow1e/aghfiZY7H2DFJIQ61okNrUfo
3tdNPtxT1Rr2QyA0Zv/lZ3/Z/Daux/Sb1gvLXBuvLkzVYpu8EHmiMvATK7MD+ZXv
ZTeREh2UB4grlcLq4mc9uTkiARNAhBrEBrYwMeFPQlfc7zB5kiRAZHMhijah/CRg
w8eVPn09xIJhfsytkFeHoVIz7EV1pD4VNqGZD+P80GEAgVfjh++leqOvCso4CP1G
YtaOpzPfI03XcH1y0+b+sLTXduOitEyEji5h7aHe2nxbY8JRodsZ8kK1i1W8LpFN
H+wZwHh/De5Zwoz3HE5EXDgYyaxT26ehqHbPaW4lkKgGDpx6oco5AgMBAAGjODA2
MAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBYGA1UdJQEB/wQMMAoGCCsG
AQUFBwMCMA0GCSqGSIb3DQEBBQUAA4IBAQANVlLefEJ9qYboQKBq5ADjftFGWTl8
hshV+dExMSj+dnXwScdvQcfUrqpxYZWtRP7290FjGHq54AtrPeQrYxffWXkb6OaQ
el9ZX4IEViJbmCrc52ePxMRnEInrWCV8zZVoej5W63dxGf2x4bVF3o+95hD6Q5l/
Lt59MpY3J88S1x0YbNzYI7PgTBzzyR/o96ULvsKr3o5UmPGim3So4WUEEjtyFACG
EFXtvc+LtCa9pQcEAcfNnAMl4gXtGVJt/A41JPwMsQtrcBVhpIKgU6bydw+wU9AJ
a6OWmXN360ELmRmDAR1dxZwpPN7YerWG/MbKuMtfO7OM2F9vG95/ve4x
-----END CERTIFICATE-----

----BEGIN CERTIFICATE-----
MIIDJjCCAg6gAwIBAgIIYf5bBvkimRwwDQYJKoZIhvcNAQEFBQAwNjE0MDIGA1UE
AxMrZmVkZXJhdGVkLXNpZ25vbi5zeXN0ZW0uZ3NlcnZpY2VhY2NvdW50LmNvbTAe
Fw0xNzEwMjAxMTQzMzRaFw0xNzEwMjMxMjEzMzRaMDYxNDAyBgNVBAMTK2ZlZGVy
YXRlZC1zaWdub24uc3lzdGVtLmdzZXJ2aWNlYWNjb3VudC5jb20wggEiMA0GCSqG
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsf1Gm4Sl491iKCsPXa/NQOJvigRF1mb8A
BnUrnlW/MKgNaYFxPXaJn+7LrvkcsGX6R6h+u2pKHWGBFMQ9TCMmgE29VatoLkd/
KKcXpoaYhMtjtoZu49HU5+pvew9YanLu5B2mfYOMkBFh86Pegqng2PsKf1Nj8q3g
nCKfHCQzbYPjne1186RCAao7pOeyFS1boKKZn9ERue9R9ae20R7WcgZZnQmsIHNW
87ssD9obyux5QAIo2uyZ5YksR6wKkxweFyI7BKy4SMTtgjSvlATw09GSvYEiFuLI
SwTwr0m3IeM5MczrGkm45GLIXIrhY/24iMqUko4IMKdIB4PZhwu9AgMBAAGjODA2
MAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBYGA1UdJQEB/wQMMAoGCCsG
AQUFBwMCMA0GCSqGSIb3DQEBBQUAA4IBAQBV5iX6VGpeUT6ghhDNHFxPQc8G4PR7
tnSP5p+aK9ieGwaoTDreH9LnypiKBJXP0KPwMfn4G56mu2pNiLjvSCibRTuHS6vN
OjWDUwADt8VRAWfS+3LaUp3aPpQHbk+UcYXZ/HkpyMpjJnvD32+yEHuGzyK+14+B
EtTJ+AM0mkldm4f1mrL8/SiWMUuPUGVhaeZXqA0A0Ra4XSL8cBWcj+89lYhN2zcF
yLPYk3/CyKmq4fu+HrgtP07XiD3OwDOT7cZjMD64EhO5Pxjp1EqDsWllbTN/nCRg
MmmUjUC5X8JptibPxVJm8QtCUBYLXq9sHhMgkcyZ9oSj6PwD4a4wBMk7
-----END CERTIFICATE-----

----BEGIN CERTIFICATE-----
MIIDJjCCAg6gAwIBAgIIVaa5+0yJ3V8wDQYJKoZIhvcNAQEFBQAwNjE0MDIGA1UE
AxMrZmVkZXJhdGVkLXNpZ25vbi5zeXN0ZW0uZ3NlcnZpY2VhY2NvdW50LmNvbTAe
Fw0xNzEwMTgxMTQzMzRaFw0xNzEwMjExMjEzMzRaMDYxNDAyBgNVBAMTK2ZlZGVy
YXRlZC1zaWdub24uc3lzdGVtLmdzZXJ2aWNlYWNjb3VudC5jb20wggEiMA0GCSqG
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZSCXl2+w/3ORI3Kp3n5RxTdweNRjo9xth
wlw4wWC7t782Cw5xzN/FQTgQOHqiSbx6oOJAkU/vXbkcWsE9NprdakDJi2W+9KTv
MHAj9WzaSMuarfi0g/SCR1bWzQI1h8a52lBBNL+TOg+KFKKQtu7am/m6SW9COfJj
ie8u+ol5FyzjQ5qd2VocmNGgCGD/HhydeU5/9JIhGkHf4fIA4QTTsASqjwB+V7df
ZWel6qJiFpuDZNifz8S8JCwpZhBtoIJDidr32SyprH0k+tpN+7C5HJunGIaxinSb
TdYKlMLUTVlOVi3h1Gxb6b5wSQkCPzaEgJXoWO2qRnlu0f51SVAxAgMBAAGjODA2
MAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBYGA1UdJQEB/wQMMAoGCCsG
AQUFBwMCMA0GCSqGSIb3DQEBBQUAA4IBAQB1D8297ANfncXclhPjm3Cw9+5AGsPX
5OCF/RKPIJDainsOSMwhiY8fNIEaENMp82N7/16woWoD87UDOxbm2Z5Rfe3sQatv
L002NXs1y19U7QuhC25cxcgUC0ESxdXnmBHoLJo8ou73GNj4UJEppNWzXxaXCXtC
cLZWPMsSBG0M9WY9/UQ2P3273SajkSKMNrAwZFzUXvuwDreKHS89Qc44/JaFCCCS
we+lXMhRfWNeBCgS+xZGKe8dUjHrGD9c3RrKbDRDZ3XuQXZgd5VfL/GgjJTcDAXA
w1zzXQWX4Y6DcU+YXuCVVdOFtBC5qrhzLsiJxhFu+LTyJxLGihQuMytu
-----END CERTIFICATE-----

Answer 5

Every time the installer wiping the directories, so you can’t install via UI.

So run installer batch file after updating organization RootCA on file:

C:\Users\<username>\AppData\Local\Google\Cloud SDK\google-cloud-sdk\lib\third_party\certifi\ cacert.pem

Answer 6

I just spent hours trying to make the installer run trying to edit ca cert files but the installer keeps wiping the directories as part of the installation process. In order to make the bundle gcloud sdk installer work, I ended up having to create an environment variable SSL_CERT_FILE and setting the path to a ca cert text file that contained the Google CAs + my company's proxy CA cert. Then the installer ran without issue. It seems that env variable is used by the python http client for CA validation.

Then you need to run gcloud config set custom_ca_certs_file before running gcloud init