Bug - SSL: CERTIFICATE_VERIFY_FAILED for upload files

[mjanez]

Error: b"HTTPSConnectionPool(host='pre.gis.miteco.gob.es', port=443): Max retries exceeded with url: /catalogo/dataset/ef76613f-f470-541b-abbc-9cd61a910744/resource/6f4f0778-1196-4b58-99fe-b78c3e70cb56/download/example.csv?&nonce=1730122025.5737107 (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)'))) status=None url=https://my-ckan-instance/catalogo/dataset/ef76613f-f470-541b-abbc-9cd61a910744/resource/6f4f0778-1196-4b58-99fe-b78c3e70cb56/download/example.csv response=None"

Typically this means that you were unable to verify the authenticity of the certificate presented by the server when checking it against your CA certificate bundle.

The particular message: unable to get local issuer certificate indicates that the path to the CA bundle is either missing, or that the CA cert is not in your bundle.

ckanext-xloader/ckanext/xloader/jobs.py

Lines 294 to 332 in 26f141d

	# fetch the resource data
	logger.info('Fetching from: {0}'.format(url))
	tmp_file = get_tmp_file(url)
	length = 0
	m = hashlib.md5()
	cl = None
	try:
	headers = {}
	if resource.get('url_type') == 'upload':
	# If this is an uploaded file to CKAN, authenticate the request,
	# otherwise we won't get file from private resources
	headers['Authorization'] = api_key
	# Add a constantly changing parameter to bypass URL caching.
	# If we're running XLoader, then either the resource has
	# changed, or something went wrong and we want a clean start.
	# Either way, we don't want a cached file.
	download_url = url_parts._replace(
	query='{}&nonce={}'.format(url_parts.query, time.time())
	).geturl()
	else:
	download_url = url
	response = get_response(download_url, headers)
	cl = response.headers.get('content-length')
	if cl and int(cl) > MAX_CONTENT_LENGTH:
	response.close()
	raise DataTooBigError()
	# download the file to a tempfile on disk
	for chunk in response.iter_content(CHUNK_SIZE):
	length += len(chunk)
	if length > MAX_CONTENT_LENGTH:
	raise DataTooBigError
	tmp_file.write(chunk)
	m.update(chunk)
	response.close()
	data['datastore_contains_all_records_of_source_file'] = True

Note

More info: ckan#151
https://stackoverflow.com/questions/77442172/ssl-certificate-verify-failed-certificate-verify-failed-unable-to-get-local-is