[Errno socket error] [Errno 1] _ssl.c:480: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

Thank you for taking the time to report this crash and helping to make Ubuntu better. This particular crash has already been reported and is a duplicate of bug #460445, so is being marked as such. Please look at the other bug report to see if there is any missing information that you can provide, or to see if there is a workaround for the bug. Additionally, any further discussion regarding the bug should occur in the other report. Please continue to report any other bugs you may find.

Rodney,

as I see you've been assigned this bug, do you have any clue as to what the root cause of the problem is? I might have some package missing, since I upgraded from Hardy to Jaunty, and then to Karmic, but apt seems happy and I made sure that ubuntu-desktop, -standard and -minimal are all installed.

Since I can connect to Ubuntu One services from two other boxes, and can't connect from this particular box from a test account, I presume the problem is system-wide as oposed to a user configuration problem. If you think otherwise, please advise which files I should move/delete in order to start fresh.

One interesing information that might or not be useful is that I can sync Tomboy notes to Ubuntu One (desktop couch?), even if I can't connect with the u1 applet.

Hi Felipe,

Have you updated to the update version in Karmic (1.0.2-0ubuntu2) yet? I'd like to know if you still get the same error with that version as well. Also, are you using a proxy? And, finally, can you verify that the following files are on your system, and readable as your normal user?

/etc/ssl/certs/UbuntuOne-Go_Daddy_CA.pem
/etc/ssl/certs/UbuntuOne-Go_Daddy_Class_2_CA.pem

Thanks!

Rodney,

Yes I have the latest updates, and the files exist, are regular files (as oposed to symlinks or even broken links) and are globally readable. I'll try again from scratch with a test account, to make sure I'm not missing anything.

philsf@peralta:~$ ll /etc/ssl/certs/UbuntuOne-Go_Daddy_CA.pem /etc/ssl/certs/UbuntuOne-Go_Daddy_Class_2_CA.pem
-rw-r--r-- 1 root root 1.8K 2009-10-12 11:24 /etc/ssl/certs/UbuntuOne-Go_Daddy_CA.pem
-rw-r--r-- 1 root root 1.5K 2009-10-12 11:24 /etc/ssl/certs/UbuntuOne-Go_Daddy_Class_2_CA.pem

philsf@peralta:~$ file /etc/ssl/certs/UbuntuOne-Go_Daddy_CA.pem /etc/ssl/certs/UbuntuOne-Go_Daddy_Class_2_CA.pem
/etc/ssl/certs/UbuntuOne-Go_Daddy_CA.pem: PEM certificate
/etc/ssl/certs/UbuntuOne-Go_Daddy_Class_2_CA.pem: PEM certificate

philsf@peralta:~$ dpkg -l ubuntuone-client\*
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Cfg-files/Unpacked/Failed-cfg/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Description
+++-============================-============================-========================================================================
ii ubuntuone-client 1.0.2-0ubuntu2 Ubuntu One client
ii ubuntuone-client-gnome 1.0.2-0ubuntu2 Ubuntu One client GNOME integration
philsf@peralta:~$

I upgraded this box to Lucid beta today, and still get the same error. UbuntuOne client is unusable in this desktop, although I can use it normally in my laptop and workstation.

Felipe, could you please try running
$ sudo update-ca-certificates
on your desktop and try to restart the application.

Additionally, could you please archive the contents of /etc/ssl/certs and attach that to this bug report.
Is UbuntuOne the only application that is failing with SSL errors?

Could you please try running wget as
$ wget https://one.ubuntu.com/ -o /tmp/test-460851

And see whether it complains about the certificate?

Roman,

Yes, Ubuntu One is the only application that fails with SSL errors, although I get sporadic warnings in pidgin while connecting to msn.

The command update-ca-certificates yielded no results, and wget also fails with SSL error.

I'm attaching the files requested. Thanks for the attention.

I've had a similar error message (SSL3_GET_SERVER_CERTIFICATE:certificate verify failed) on a different application. The solution was to delete/rename the cacert.pem that ended up in my user's home directory.