disabling tls certificate checking not working

Question

I'm having issues in android (kivy) about ssl verification:

02-12 18:19:15.622  5082  5116 I python  :  geopy.exc.GeocoderUnavailable: HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Max retries exceeded with url: /search?q=Buenos+Aires+Argentina&format=json&limit=1 (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)')))

So I would like to change ssl context to ignore verification completely until I found right settings to make it work, I read this page on official documentation, in order to be able to turn off ssl verification: https://geopy.readthedocs.io/en/stable/#geopy.geocoders.options.default_ssl_context but it doesn't change anything.

So I used the example on mine method like this:

    def _locating_place(self, place, country) -> Point:
        # self.ssl_ctx is a boolean variable set to True if the app runs in android
        if self.ssl_ctx:
            Logger.info('setting custom ssl context')
            ctx = ssl.create_default_context()
            ctx.check_hostname = False
            ctx.verify_mode = ssl.CERT_NONE
            geopy.geocoders.options.default_ssl_context = ctx
            geolocator = Nominatim(user_agent='myapplication')
        else:
            geolocator = Nominatim(user_agent='myapplication')
        location = geolocator.geocode(f"{place} {country}")

I also tried passing context ctx like this: geolocator = Nominatim(user_agent='myapplication', ssl_context=ctx), the result is the same, mine code once reaches geocode() method call, in android, fails verifying ssl certificate, like this:

02-12 18:19:15.621  5082  5116 I python  :    File "/srv/buildozer_build_dir/android/app/lib/weather/weather_getter.py", line 312, in _locating_place
02-12 18:19:15.621  5082  5116 I python  :    File "/srv/buildozer_build_dir/android/platform/build-armeabi-v7a_x86_64_x86_arm64-v8a/build/python-installs/travel_lint/x86/geopy/geocoders/nominatim.py", line 297, in geocode
02-12 18:19:15.621  5082  5116 I python  :    File "/srv/buildozer_build_dir/android/platform/build-armeabi-v7a_x86_64_x86_arm64-v8a/build/python-installs/travel_lint/x86/geopy/geocoders/base.py", line 368, in _call_geocoder
02-12 18:19:15.621  5082  5116 I python  :    File "/srv/buildozer_build_dir/android/platform/build-armeabi-v7a_x86_64_x86_arm64-v8a/build/python-installs/travel_lint/x86/geopy/adapters.py", line 447, in get_json
02-12 18:19:15.622  5082  5116 I python  :    File "/srv/buildozer_build_dir/android/platform/build-armeabi-v7a_x86_64_x86_arm64-v8a/build/python-installs/travel_lint/x86/geopy/adapters.py", line 469, in _request
02-12 18:19:15.622  5082  5116 I python  :  geopy.exc.GeocoderUnavailable: HTTPSConnectionPool(host='nominatim.openstreetmap.org', port=443): Max retries exceeded with url: /search?q=Buenos+Aires+Argentina&format=json&limit=1 (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)')))
02-12 18:19:15.622  5082  5116 I python  : Python for android ended.

Am I doing something wrong? Do I need to change Nominatim instantiation or pass some arguments to geocode method?

KostyaEsmukov · Answer 1 · 2023-02-18T14:34:50.460

0

According to the stacktrace you provided geopy attempts to use the RequestsAdapter. You may check if urllib3 version in your environment is greater than 1.24.2, see https://github.com/geopy/geopy/blob/ef48a8cbb85f842c0820333e53e7ebde7db382a3/geopy/adapters.py#L642-L649

Or you may try a different adapter, for example, the basic URLLibAdapter:

ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE

geolocator = Nominatim(
    user_agent='myapplication', 
    ssl_context=ctx, 
    adapter_factory=geopy.adapters.URLLibAdapter,
)

edited Feb 18 '23 at 14:34

answered Feb 15 '23 at 17:47

KostyaEsmukov

848
6
11

now it is working, the only typo in code you suggested is `ctx=ctx` instead of `ssl_context=ctx`. Thank you very much. In any case I have an urllib3 version of 1.26.14 so for what I saw in code you pointed me, I should not have the bug. Thank you very much. – magowiz Feb 16 '23 at 23:21
It might be a different issue with urllib3 then, perhaps even an Android-specific one. – KostyaEsmukov Feb 18 '23 at 14:36

disabling tls certificate checking not working

1 Answers1