gsutil Failure: [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

Question

I am getting the below error message while trying to access my google cloud storage from one of my Google Compute Engine instance using gsutil command. Below is the command and error message.

Command:

gsutil ls gs://my-storage-bucket

Error message:

Your "Oauth 2.0 User Account" credentials are invalid. For more help, see "gsutil help creds", or re-run the gsutil config command (see "gsutil help config").
Failure: [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed.

I also tried authenticating the SDK using gcloud auth login and gsutil config and was also able to generate authorization code from the link generated after running the command gsutil config. The command again exited with the same error message. I did not get any solution even after searching for hours. The command was working fine few days before and it is not throwing any error in my local machine and other instances. Please help me out.

Canyon

Answer 1

I know, it's been late to answer here. But I have faced such situation and it got fixed by upgrading the gcloud.

Here is the link of my blog post, hope it helps. https://easyonror.wordpress.com/2018/10/24/anexperience-with-fixing-gsutil/

Tshombe

Answer 2

Are you using an old version of gsutil? There have been a lot of upgrades in the past few versions to the libraries that gsutil depends on for handling HTTP requests. I've seen ~5 mentions of this error in the past couple weeks, and nearly all of them have been fixed by updating gsutil.

However, if it's not possible for you to update gsutil, check for any recent updates your system's OpenSSL package. I've seen one person mention that this happened after moving from 1.0.1 to 1.0.2, and that moving back to 1.0.1 made the error stop appearing. However, I'd generally not advise downgrading a security library, and would suggest trying all reasonable alternatives before resorting to that.

Luff

Just adding up to @mhouglum's answer, you can try running gcloud components update to get the latest gsutil version. Also, please make sure that you login once again after the update, so that the old credentials are no longer used. Use gcloud auth login [YOUR_ACCOUNT] and, after the login, try the same operation you did before. – Metastasize