Failed to install PlatformIO IDE ([[object Object]]unable to get local issuer certificate)

marcosjl31 · September 13, 2022, 9:47am

Hi *,

I’m trying to install PlatformIO IDE on top of VSCode on an ubuntu 22.04.
VSCode is version 1.71 installed from tar.gz (not snap).

At my company we have a corporate proxy deciphering all the SSL protocol (for security reasons).

To avoid using the form “http://user:password@proxy:port” I’ve installed a CNTLM on my machine and I define my http[s]_proxy variables to “http://localhost:6633”

I’ve installed on my local machine the certificates needed to allow SSL traffic through the proxy in /usr/local/share/ca-certificates and issued a update-ca-certificates command.

When installing PlatformIO IDE from extensions mananager, I get an error : Failed to install PlatformIO IDE.
Developer tools/console shows :

Error: /home/cnes/marcosjl/.platformio/.cache/tmp/.piocore-installer-licuykob/tmp1u2vhrp6/pioinstaller.zip/urllib3/connectionpool.py:1043: InsecureRequestWarning: Unverified HTTPS request is being made to host 'localhost'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings /home/cnes/marcosjl/.platformio/.cache/tmp/.piocore-installer-licuykob/tmp1u2vhrp6/pioinstaller.zip/urllib3/connectionpool.py:1043: InsecureRequestWarning: Unverified HTTPS request is being made to host 'localhost'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnin...
onDidChangeNotification @ notificationsAlerts.ts:42

console.ts:137 [Extension Host] rejected promise not handled within 1 second: RequestError: unable to get local issuer certificate
y @ console.ts:137
console.ts:137 [Extension Host] stack trace: RequestError: unable to get local issuer certificate
	at ClientRequest.<anonymous> (/home/cnes/marcosjl/.vscode/extensions/platformio.platformio-ide-2.5.4-linux-x64/node_modules/got/dist/source/core/index.js:970:111)
	at Object.onceWrapper (node:events:646:26)
	at ClientRequest.emit (node:events:538:35)
	at ClientRequest.emit (node:domain:475:12)
	at origin.emit (/home/cnes/marcosjl/.vscode/extensions/platformio.platformio-ide-2.5.4-linux-x64/node_modules/@szmarczak/http-timer/dist/source/index.js:43:20)
	at TLSSocket.socketErrorListener (node:_http_client:442:9)
	at TLSSocket.emit (node:events:526:28)
	at TLSSocket.emit (node:domain:475:12)
	at emitErrorNT (node:internal/streams/destroy:157:8)
	at emitErrorCloseNT (node:internal/streams/destroy:122:3)
	at process.processTicksAndRejections (node:internal/process/task_queues:83:21)
	at TLSSocket.onConnectSecure (node:_tls_wrap:1530:34)
	at TLSSocket.emit (node:events:526:28)
	at TLSSocket.emit (node:domain:475:12)
	at TLSSocket._finishInit (node:_tls_wrap:944:8)
	at ssl.onhandshakedone (node:_tls_wrap:725:12)
y @ console.ts:137

[[object Object]]unable to get local issuer certificate
$onExtensionRuntimeError @ mainThreadExtensionService.ts:79
mainThreadExtensionService.ts:80 RequestError: unable to get local issuer certificate
	at ClientRequest.<anonymous> (/home/cnes/marcosjl/.vscode/extensions/platformio.platformio-ide-2.5.4-linux-x64/node_modules/got/dist/source/core/index.js:970:111)
	at Object.onceWrapper (node:events:646:26)
	at ClientRequest.emit (node:events:538:35)

	at ClientRequest.emit (node:domain:475:12)
	at origin.emit (/home/cnes/marcosjl/.vscode/extensions/platformio.platformio-ide-2.5.4-linux-x64/node_modules/@szmarczak/http-timer/dist/source/index.js:43:20)
	at TLSSocket.socketErrorListener (node:_http_client:442:9)
	at TLSSocket.emit (node:events:526:28)
	at TLSSocket.emit (node:domain:475:12)
	at emitErrorNT (node:internal/streams/destroy:157:8)
	at emitErrorCloseNT (node:internal/streams/destroy:122:3)
	at process.processTicksAndRejections (node:internal/process/task_queues:83:21)
	at TLSSocket.onConnectSecure (node:_tls_wrap:1530:34)
	at TLSSocket.emit (node:events:526:28)
	at TLSSocket.emit (node:domain:475:12)
	at TLSSocket._finishInit (node:_tls_wrap:944:8)
	at ssl.onhandshakedone (node:_tls_wrap:725:12)
$onExtensionRuntimeError @ mainThreadExtensionService.ts:80
workbench.html:1 [.WebGL-0x153c01c50600]GL Driver Message (OpenGL, Performance, GL_CLOSE_PATH_NV, High): GPU stall due to ReadPixels
workbench.html:1 [.WebGL-0x153c01c50600]GL Driver Message (OpenGL, Performance, GL_CLOSE_PATH_NV, High): GPU stall due to ReadPixels
workbench.html:1 [.WebGL-0x153c01c50600]GL Driver Message (OpenGL, Performance, GL_CLOSE_PATH_NV, High): GPU stall due to ReadPixels
workbench.html:1 [.WebGL-0x153c01c50600]GL Driver Message (OpenGL, Performance, GL_CLOSE_PATH_NV, High): GPU stall due to ReadPixels (this message will no longer repeat)
contextKeyService.ts:452 Element already has context attribute: pane, expanded, horizontal
c @ contextKeyService.ts:452

Any hint really appreciated as this has worked on CentOS 7 machines…

Regards
José

maxgerhardt · September 13, 2022, 10:11am

And you set that URL as your proxy and disabled strict SSL per the documentation?

https://docs.platformio.org/en/latest/integration/ide/vscode.html#proxy-server-support

marcosjl31 · September 13, 2022, 11:02am

Hi
Yes. The settings.json file contains :

{
    "workbench.colorTheme": "Visual Studio Dark",
    "workbench.iconTheme": "vscode-icons",
    "C_Cpp.updateChannel": "Insiders",
    "cmake.configureOnOpen": false,
    "git.ignoreLegacyWarning": true,
    "telemetry.enableTelemetry": false,
    "telemetry.enableCrashReporter": false,
    "editor.wordWrap": "on",
    "http.proxyAuthorization": null,
    "http.systemCertificates": false,
    "http.proxyStrictSSL": false
}

marcosjl31 · September 13, 2022, 11:17am

I did a complete delete of all VScode and PlatformIO files and dir (.vscode, .config/Code, .platformio).

And again define proxy and set to false http.systemCertificates and http.proxyStrictSSL.

Unsuccessfully…

José

maxgerhardt · September 13, 2022, 11:41am

Maybe @ivankravets has an idea about these proxy settings?

marcosjl31 · September 13, 2022, 1:20pm

I’ve tried to install pio core in CLI mode…

here is the command I used :

python3 -c "$(curl -fsSL https://raw.githubusercontent.com/platformio/platformio/develop/scripts/get-platformio.py)"

This command works fine on my CentOS 7 machine (with exactly the same setup : same CNTLM listening on localhost:6633, http_proxy and https_proxy variables, same certificates installed). But on Ubuntu, here is the output :

marcosjl@tu-ubuntuq-p01 tmp $ python3 -c "$(curl -fsSL https://raw.githubusercontent.com/platformio/platformio/develop/scripts/get-platformio.py)"
Installer version: 1.1.2
Platform: Linux-5.15.0-47-generic-x86_64-with-glibc2.35
Python version: 3.10.4 (main, Jun 29 2022, 12:14:53) [GCC 11.2.0]
Python path: /usr/bin/python3
Creating a virtual environment at /home/marcosjl/.platformio/penv
/usr/bin/python3
Traceback (most recent call last):
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/urllib3/connectionpool.py", line 700, in urlopen
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/urllib3/connectionpool.py", line 994, in _prepare_proxy
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/urllib3/connection.py", line 414, in connect
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/urllib3/util/ssl_.py", line 449, in ssl_wrap_socket
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/urllib3/util/ssl_.py", line 493, in _ssl_wrap_socket_impl
  File "/usr/lib/python3.10/ssl.py", line 512, in wrap_socket
    return self.sslsocket_class._create(
  File "/usr/lib/python3.10/ssl.py", line 1070, in _create
    self.do_handshake()
  File "/usr/lib/python3.10/ssl.py", line 1341, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/requests/adapters.py", line 440, in send
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/urllib3/connectionpool.py", line 785, in urlopen
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/urllib3/util/retry.py", line 592, in increment
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='api.registry.platformio.org', port=443): Max retries exceeded with url: /v3/packages/platformio/tool/python-portable (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/tmp/tmpac9qs_43", line 68, in <module>
    main()
  File "/tmp/tmpac9qs_43", line 60, in main
    bootstrap()
  File "/tmp/tmpac9qs_43", line 46, in bootstrap
    pioinstaller.__main__.main()
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/pioinstaller/__main__.py", line 133, in main
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/click/core.py", line 1128, in __call__
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/click/core.py", line 1053, in main
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/click/core.py", line 1637, in invoke
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/click/core.py", line 1395, in invoke
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/click/core.py", line 754, in invoke
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/click/decorators.py", line 26, in new_func
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/pioinstaller/__main__.py", line 61, in cli
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/pioinstaller/core.py", line 70, in install_platformio_core
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/pioinstaller/core.py", line 98, in _install_platformio_core
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/pioinstaller/penv.py", line 58, in create_core_penv
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/pioinstaller/python.py", line 70, in fetch_portable_python
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/pioinstaller/python.py", line 97, in get_portable_python_url
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/requests/api.py", line 75, in get
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/requests/api.py", line 61, in request
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/requests/sessions.py", line 529, in request
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/requests/sessions.py", line 645, in send
  File "/tmp/.piocore-installer-dq7l7zqj/tmp6y0ab_u8/pioinstaller.zip/requests/adapters.py", line 517, in send
requests.exceptions.SSLError: HTTPSConnectionPool(host='api.registry.platformio.org', port=443): Max retries exceeded with url: /v3/packages/platformio/tool/python-portable (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)')))
Traceback (most recent call last):
  File "<string>", line 105, in <module>
  File "<string>", line 101, in main
  File "/usr/lib/python3.10/subprocess.py", line 369, in check_call
    raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['/usr/bin/python3', '/tmp/tmpac9qs_43']' returned non-zero exit status 1.

marcosjl31 · September 13, 2022, 1:37pm

Small precision :

On CentOS I’m running VSCode 1.52 (latest supported version on CentOS 7)
On Ubuntu I run VSCode 1.71 (latest version available)

marcosjl31 · September 13, 2022, 2:40pm

Ok… I think I found the problem…

I guess corporate proxy configuration has changed and that *.https://registry.platformio.org/ are no more in the white list of the proxy:

I guess that certificates shown in previous picture are not correct in order to access platformio.org URLs

Regards,
José

marcosjl31 · September 15, 2022, 2:40pm

Hi,

Sites *.platformio.org have been added to proxy white list, but this does not solve my installing issue.
I still get this message during platformio core installation

Error: /home/cnes/marcosjl/.platformio/.cache/tmp/.piocore-installer-tcyvug4p/tmpexux44z8/pioinstaller.zip/urllib3/connectionpool.py:1043: InsecureRequestWarning: Unverified HTTPS request is being made to host 'localhost'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings /home/cnes/marcosjl/.platformio/.cache/tmp/.piocore-installer-tcyvug4p/tmpexux44z8/pioinstaller.zip/urllib3/connectionpool.py:1043: InsecureRequestWarning: Unverified HTTPS request is being made to host 'localhost'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnin...
onDidChangeNotification @ notificationsAlerts.ts:42

marcosjl31 · September 15, 2022, 3:50pm

Hello again,

I’m puzzled !
I’ve managed to install PlatformIO IDE on a corporate Windows machine using the exact same configuration as the one I’m trying to use on Ubuntu 22.04 :

VS Code : 1.71
Local CNTLM proxy running in background
HTTP_PROXY and HTTPS_PROXY variables defined for my Windows account and pointing to CNTLM port.
VS Code settings to disable proxyStrictSSL

So to me it’s a problem of certificates not correctly configured in Ubuntu : I droped the AC *.crt files under /usr/local/share/ca_certificates and ran update-ca-certificates command.

But that’s not just enough…

Regards
Jose

maxgerhardt · September 15, 2022, 7:53pm

But if those are “system certifcates”, wouldn’t you want to set

to true?

marcosjl31 · September 16, 2022, 8:51am

Setting http.systemCertificates to true does not change the installation error.

marcosjl31 · September 26, 2022, 1:18pm

Ok.
I found a work around to my problem…
Following information provided here : https://stackoverflow.com/questions/36506539/how-do-i-get-visual-studio-code-to-trust-our-self-signed-proxy-certificate I managed to add my corporate AC certificates and thus have Visual Studio Code access properly to Internet through our corporate proxy.

This thread can be closed.