SSL certificate expired? Stuck on "Collecting Packages"

Like other issues #8 Package Control is stuck on collecting the packages.

I looked at the console, and it mentions something about the SSL certificate:

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "D:\USER-SOFTWARE\WindowsUtilities\Keypirinha\portable\Profile\InstalledPackages\PackageControl.keypirinha-package\packagecontrol.py", line 455, in _get_available_packages
  File "D:\USER-SOFTWARE\WindowsUtilities\Keypirinha\portable\Profile\InstalledPackages\PackageControl.keypirinha-package\packagecontrol.py", line 435, in _get_available_packages
  File "D:\USER-SOFTWARE\WindowsUtilities\Keypirinha\python\site\keypirinha_net.py", line 40, in open
    fullurl, *args, data=data, timeout=timeout, **kwargs)
  File "lib\urllib\request.py", line 525, in open
  File "lib\urllib\request.py", line 543, in _open
  File "lib\urllib\request.py", line 503, in _call_chain
  File "lib\urllib\request.py", line 1360, in https_open
  File "lib\urllib\request.py", line 1319, in do_open
urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1076)>
12:01:41.739 ** ERROR: Error from PackageControl.PackageControl.on_suggest: <class 'TypeError'>: 'NoneType' object is not iterable
Traceback (most recent call last):
  File "D:\USER-SOFTWARE\WindowsUtilities\Keypirinha\portable\Profile\InstalledPackages\PackageControl.keypirinha-package\packagecontrol.py", line 199, in on_suggest

I tried reinstalling manually (copied latest release into “InstalledPackages” directory, overwriting “old” version), but the error seems to persist.

[ueffel]

That’s weird.

So the SSL Certificate from ue.spdns.de (were the package repository is hosted) is valid. In October of last year some Let’s Encrypt Root Certificate expired and some windows systems (mine included) did not automatically got this certificate removed and somehow try to validate certificates to the wrong certificate chain. I don’t know much about it but I noticed that already in https://github.com/Keypirinha/Keypirinha/issues/527.
Edit: Also some has noticed the same in the chatroom https://gitter.im/Keypirinha/Keypirinha?at=625280120466b352a45d6b29

But that’s not the weird part. The plugin should try the alternate repository @ https://ueffel.pythonanywhere.com/ the get the package list but that has to fail also in your case. I wonder why.

Could you do the following:

• enable debug mode of packagecontrol by using Keypirinha: Configure Package: PackageControl and entering debug = yes in the right file
• run PackageControl: Update Repository List
• open the keypirinha console Keypirinha: Console and copy the contents here?

After that you can solve your problem by deleting the expired certificate manually by following this: https://community.certifytheweb.com/t/upcoming-expiry-of-dst-root-ca-x3-and-r3-intermediate-for-lets-encrypt/1480/7 (and disable debug mode by setting debug = no or deleting the line)

[ueffel]

should be like this.

The wrong chain has a “DST Root CA X3” certificate in it, i think