Android repo init : SSL_CERTIFICATE_VERIFY_FAILED error

Question

For downloading the Android Source code :

I am issuing

repo init -u https://android.googlesource.com/platform/manifest

But I am getting the below error :

fatal: Cannot get https://gerrit.googlesource.com/git-repo/clone.bundle
fatal: error [SSL_CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c :726)
fatal: cloning the git-repo repository,will remove '.repo/repo'

What I have tried ?

-I have tried visiting https://android.googlesource.com/platform/manifest and https://gerrit.googlesource.com/git-repo/clone.bundle from the google chrome and internet explorer and there is no issue

-Tried changing the https to http in the repo init command

-modified the repo script and changed https to http

-modified the gitconfig as below :

[user]
        name = myName
        email = myemail.id
[http]
        proxy = http://user:passwd@gateway.com:8080
        sslVerify = false
[https]
        proxy = https://user:passwd@gateway.com:8080
        sslVerify = false

How can I import the certificates for these sites ? I am using Ubuntu 18.04 . Is there a way to force ignore this?

PS : I am behind the proxy and have already setup the proxy settings and it is working fine.(tried sudo apt-get update)

Answer 1

i am a MAC user (Mojave). I have the same error.

When i launch:

repo init <repository url>

I get this error:

Downloading Repo source from https://gerrit.googlesource.com/git-repo
fatal: Cannot get https://gerrit.googlesource.com/git-repo/clone.bundle
fatal: error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)
fatal: cloning the git-repo repository failed, will remove '.repo/repo'

The problem seems due to Python 3.6 on MacOS that comes with its own private copy of OpenSSL. That means the trust certificates in the system are no longer used as defaults by the Python ssl module. To fix that, you need to install a certifi package in your system.

Solved with:

open /Applications/Python\ 3.6/Install\ Certificates.command

Answer 2

OK , I fixed this by setting the environment variable PYTHONHTTPSVERIFY to 0

export PYTHONHTTPSVERIFY=0

Python, since v2.7.9, will by default now check the SSL certificates. To revert to the correct behavior for the repo script, set up an environment variable PYTHONHTTPSVERIFY=0.
This will shut off all certificate verification.

The repo script should now run as advertised.

Answer 3

I spent 3 hours on this topic and finally found these command works for me.

My python3 is Python 3.6.9 and python is Python 2.7.17 running on Ubuntu 18.04.

sudo apt-get install git-core gnupg flex bison build-essential zip curl zlib1g-dev gcc-multilib g++-multilib libc6-dev-i386 lib32ncurses5-dev x11proto-core-dev libx11-dev lib32z1-dev libgl1-mesa-dev libxml2-utils xsltproc unzip fontconfig
sudo apt-get install openjdk-8-jdk android-tools-adb bc bison build-essential curl flex g++-multilib gcc-multilib gnupg gperf imagemagick lib32ncurses5-dev lib32readline-dev lib32z1-dev liblz4-tool libncurses5-dev libsdl1.2-dev libssl-dev libwxgtk3.0-gtk3-dev libxml2 libxml2-utils lzop pngcrush rsync schedtool squashfs-tools xsltproc yasm zip zlib1g-dev git-core python3.8 libncurses5
sudo apt-get install ca-certificates
sudo update-ca-certificates --fresh
sudo update-alternatives --install /bin/python python /usr/bin/python3 1
sudo update-alternatives --install /bin/python python /usr/bin/python3.8 2
sudo update-alternatives --config python //choose 2
mkdir ~/bin
PATH=~/bin:$PATH
curl -k https://storage.googleapis.com/git-repo-downloads/repo-1 > ~/bin/repo
chmod a+x repo 
git config http.sslVerify false
export PYTHONHTTPSVERIFY=0
git config --global user.name "xxx"
git config --global user.name "xxx@xxx.com"
mkdir ./workspace
cd workspace
which repo
repo init -u https://android.googlesource.com/platform/manifest -b master
repo sync -j2

Hope my sharing could help you :)