python - 由于 SSL 错误，无法让 virtualenv 工作

Question

我正在尝试在我的 Mac (El Capitan) 上使用 virtualenv，但最近一定发生了一些变化，因为它不再工作，并且提示 SSL 问题。

这是大约 9 个月以来我第一次不得不使用这个项目，在那段时间里，我没有在我的系统上更改任何关于 Python 的内容。

为了让它正常工作，在过去一天左右的时间里，我卸载了 virtualenv，手动删除了一些文件(我在 GitHub 问题中找到了这些说明，但我找不到它们来提供链接，但如果我没记错的话，它只是删除了损坏的符号链接(symbolic link)和与 virtualenv 相关的目录，) 然后通过 Brew 卸载了 Python，给我留下了一个没有 Python、pip 或 virtualenv 库或可执行文件的系统。

然后我运行 brew install python2 来安装 Python。然后我运行了 pip install virtualenv ，这给了我和以前一样的 SSL 错误。我从 pip 试图从中下载它的 URL 手动下载了 virtualenv，然后 pip 使用下载的文件在本地安装了它。这奏效了。但是，当我随后运行 virtualenv venv 时，我仍然遇到相同的 SSL 错误。

我见过提供各种建议的问题，从下载 DigiCertHighAssuranceEVRootCA.pem 并通过 --cert 选项使用它，创建一个 pip.ini 文件trusted-host=files.pythonhosted.org 在其中，使用 --trusted-host 选项，使用不是我公司公司网络的不同网络，但没有到目前为止，它对我有用。

每当我尝试 pip 安装任何东西，或者在这个特定示例中，创建一个新的 virtualenv 时，我总是收到以下 SSL 错误:

New python executable in /Users/apl/Projects/fdm/FDM-fordele/venv/bin/python2.7
Also creating executable in /Users/apl/Projects/fdm/FDM-fordele/venv/bin/python
Installing setuptools, pip, wheel...
  Complete output from command /Users/apl/Projects/...e/venv/bin/python2.7 - setuptools pip wheel:
  Looking in links: /usr/local/lib/python2.7/site-packages, /usr/local/lib/python2.7/site-packages/virtualenv_support, /usr/local/lib/python2.7/site-packages/virtualenv_support
Collecting setuptools
  Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),)': /s/files.pythonhosted.org/packages/96/06/c8ee69628191285ddddffb277bd5abdf769166e7a14b867c2a172f0175b1/setuptools-40.4.3-py2.py3-none-any.whl?X-OpenDNS-Session=_0a895c9402cc904c260a26007e7f555cbe499270f445_8d79d41f_
  Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),)': /s/files.pythonhosted.org/packages/96/06/c8ee69628191285ddddffb277bd5abdf769166e7a14b867c2a172f0175b1/setuptools-40.4.3-py2.py3-none-any.whl?X-OpenDNS-Session=_0a895c9402cc904c260a26007e7f555cbe499270f445_8d79d41f_
  Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),)': /s/files.pythonhosted.org/packages/96/06/c8ee69628191285ddddffb277bd5abdf769166e7a14b867c2a172f0175b1/setuptools-40.4.3-py2.py3-none-any.whl?X-OpenDNS-Session=_0a895c9402cc904c260a26007e7f555cbe499270f445_8d79d41f_
  Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),)': /s/files.pythonhosted.org/packages/96/06/c8ee69628191285ddddffb277bd5abdf769166e7a14b867c2a172f0175b1/setuptools-40.4.3-py2.py3-none-any.whl?X-OpenDNS-Session=_0a895c9402cc904c260a26007e7f555cbe499270f445_8d79d41f_
  Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),)': /s/files.pythonhosted.org/packages/96/06/c8ee69628191285ddddffb277bd5abdf769166e7a14b867c2a172f0175b1/setuptools-40.4.3-py2.py3-none-any.whl?X-OpenDNS-Session=_0a895c9402cc904c260a26007e7f555cbe499270f445_8d79d41f_
Could not install packages due to an EnvironmentError: HTTPSConnectionPool(host='files.pythonhosted.org.x.0a895c9402cc904c260a26007e7f555cbe49.9270f445.id.opendns.com', port=443): Max retries exceeded with url: /s/files.pythonhosted.org/packages/96/06/c8ee69628191285ddddffb277bd5abdf769166e7a14b867c2a172f0175b1/setuptools-40.4.3-py2.py3-none-any.whl?X-OpenDNS-Session=_0a895c9402cc904c260a26007e7f555cbe499270f445_8d79d41f_ (Caused by SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),))

还有其他方法可以让它发挥作用吗？由于此错误，无法部署此项目(使用名为 ansistrano 的 Ansible 角色)。

编辑:

我刚刚尝试再次卸载/删除 Virtualenv、Pip 和 Python，重新安装 Python，然后使用 https://bootstrap.pypa.io/get-pip.py 手动安装 pip ，它给出:

Collecting pip
  Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),)': /s/files.pythonhosted.org/packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl?X-OpenDNS-Session=_0cf307740aff804587084980d2ecedab4cc89270f445_80300092_
  Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),)': /s/files.pythonhosted.org/packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl?X-OpenDNS-Session=_0cf307740aff804587084980d2ecedab4cc89270f445_80300092_
  Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),)': /s/files.pythonhosted.org/packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl?X-OpenDNS-Session=_0cf307740aff804587084980d2ecedab4cc89270f445_80300092_
  Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),)': /s/files.pythonhosted.org/packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl?X-OpenDNS-Session=_0cf307740aff804587084980d2ecedab4cc89270f445_80300092_
  Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),)': /s/files.pythonhosted.org/packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl?X-OpenDNS-Session=_0cf307740aff804587084980d2ecedab4cc89270f445_80300092_
Could not install packages due to an EnvironmentError: HTTPSConnectionPool(host='files.pythonhosted.org.x.0cf307740aff804587084980d2ecedab4cc8.9270f445.id.opendns.com', port=443): Max retries exceeded with url: /s/files.pythonhosted.org/packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl?X-OpenDNS-Session=_0cf307740aff804587084980d2ecedab4cc89270f445_80300092_ (Caused by SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:726)'),))

Answer 1

事实证明，这是因为我工作的公司使用 Cisco 的 Umbrella DNS 安全系统，该系统将自身插入所有 DNS 请求中。显然，这会破坏 Python 中的 SSL，即使我可以使用 curl 手动成功下载文件。

通过添加

151.101.1.63 files.pythonhosted.org

我的主机文件，我能够得到一个完全符合预期的系统。希望这对将来也被迫通过 Umbrella 的其他人有所帮助。