bit off topic: bitbucket fingerprint problem

[Gregory Szorc]

On Thu, Nov 10, 2016 at 5:26 AM, Uwe Brauer <oub at mat.ucm.es> wrote:

>
> A couple of weeks ago I had a problem with fingerprint on the bitbucket
> site. Mads advised me
>
>    > Modern Python and Mercurial has proper support for system CAs. There
>    > is thus no longer much need for hostfingerprints ... unless you want
>    > to be really secure and manage trust manually and update your
>    > configuration when sites renew their certificate.
>
>    > Just remove that entry and you should be fine.
>
>
> When this was done the following error poped up:
>
> abort: error: _ssl.c:510: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate
> verify failed
>
> So that looks as if the fingerprint were missing.
>

Is that the full output? Do you not see any warning messages before this
abort?

Without an additional warning message, my guess is that CAs were loaded.
However, the CA for bitbucket.org is not present and thus the cert is
failing to verify. If that's true, the workaround is to update your CA
bundle file (your distro should provide a modern copy but if your distro
isn't receiving package updates...). You can grab a bundle file from
https://curl.haxx.se/docs/caextract.html. Or you can install the "certifi"
Python package via `pip install certifi`.

If this is the only message we show in case of missing CA, that error
messaging is horrible and could be improved. I'll investigate that...
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mercurial-scm.org/pipermail/mercurial/attachments/20161114/9876b62c/attachment-0002.html>