bad cert for vip.symantec.com (was: Make a GUI .exe?)

I’ve been trying out this tool for the past 20min, but it gives me an SSL validation error. Here’s what happens when I run vipaccess provision and variations thereof:

imree@DESKTOP-PIRJSEG ~/python-vipaccess
$ vipaccess provision -p -t VSMT
Generating request...
Fetching provisioning response...
Getting token from response...
Decrypting token...
Checking token...
Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 600, in urlopen
    chunked=chunked)
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 345, in _make_request
    self._validate_conn(conn)
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 844, in _validate_conn
    conn.connect()
  File "/usr/lib/python3.6/site-packages/urllib3/connection.py", line 326, in connect
    ssl_context=context)
  File "/usr/lib/python3.6/site-packages/urllib3/util/ssl_.py", line 324, in ssl_wrap_socket
    return context.wrap_socket(sock, server_hostname=server_hostname)
  File "/usr/lib/python3.6/ssl.py", line 407, in wrap_socket
    _context=self, _session=session)
  File "/usr/lib/python3.6/ssl.py", line 814, in __init__
    self.do_handshake()
  File "/usr/lib/python3.6/ssl.py", line 1068, in do_handshake
    self._sslobj.do_handshake()
  File "/usr/lib/python3.6/ssl.py", line 689, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:777)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/requests/adapters.py", line 423, in send
    timeout=timeout
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 630, in urlopen
    raise SSLError(e)
requests.packages.urllib3.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:777)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/bin/vipaccess", line 11, in <module>
    sys.exit(main())
  File "/usr/lib/python3.6/site-packages/vipaccess/cli.py", line 162, in main
    return args.func(p, args)
  File "/usr/lib/python3.6/site-packages/vipaccess/cli.py", line 57, in provision
    if not vp.check_token(otp_token['id'], otp_secret, session):
  File "/usr/lib/python3.6/site-packages/vipaccess/provision.py", line 200, in check_token
    'continue':'otp_check'
  File "/usr/lib/python3.6/site-packages/requests/sessions.py", line 535, in post
    return self.request('POST', url, data=data, json=json, **kwargs)
  File "/usr/lib/python3.6/site-packages/requests/sessions.py", line 488, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python3.6/site-packages/requests/sessions.py", line 609, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python3.6/site-packages/requests/adapters.py", line 497, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:777)

So can you figure out if the issue is on my end or on the vipaccess tool’s end?

[DuBistKomisch]

yep, installed the intermediate cert and manually pointed requests to it with REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt, seems to work

[DuBistKomisch]

Also seeing this suddenly, obviously symantec have updated the ssl cert on the domain. certifi was already installed, but doing a pip install --upgrade certifi to get the latest didn’t help either. curl also fails on the ubuntu 16.04 server I’m running it on, and on my arch linux laptop:

# curl https://vip.symantec.com
curl: (60) server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

And yet it works in Firefox on my laptop… and there don’t seem to be any unusual certs in the chain, not sure what’s going on.