3

When I try to intall google cloud sdk the following error occurs:

ERROR: (gcloud.components.update) Failed to fetch component listing from server. Check your network settings and try again. Google Cloud SDK installer will now exit. Press any key to continue . . .

result = func(*args)   File "C:\python27_x64\lib\urllib2.py", line 1222, in https_open
return self.do_open(httplib.HTTPSConnection, req)   File "C:\python27_x64\lib\urllib2.py", line 1184, in do_open
raise URLError(err) urllib2.URLError: <urlopen error [Errno 10061] No connection could be made because the target machine actively refused it>

Any ideas?

Tadas Davidsonas
  • 1,859
  • 4
  • 16
  • 19

2 Answers2

3

I was getting a similar error both on installation and on certain commands on another previously working installation. After poking around and adding some logs, it looks like SSL Cert Verification is failing for the component listing request from Google's servers:

$ gcloud preview managed-instance-groups ...
You do not currently have this command group installed.  Using it requires the installation of components: [preview]
Could not fetch [https://dl.google.com/dl/cloudsdk/release/components-2.json]
<urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)>
ERROR: (gcloud) Failed to fetch component listing from server. Check your network settings and try again.

To solve it (in a way that is almost certainly inadvisable), I disabled SSL Cert Validation for that single request. If you want to go down this path, modify MakeRequest() in

./google-cloud-sdk/lib/googlecloudsdk/core/updater/installers.py:248

from:

return urllib2.urlopen(req, timeout=TIMEOUT_IN_SEC)

to:

return urllib2.urlopen(req, timeout=TIMEOUT_IN_SEC, context=ssl.SSLContext(ssl.PROTOCOL_TLSv1))

(There's an issue opened for this at https://code.google.com/p/google-cloud-sdk/issues/detail?id=143.)

UPDATE: 26/05/15

In my case, this turned out to be a mismatch between my installed version of OpenSSL and the version of OpenSSL referenced by Python (this may have started happening after updating to OpenSSL@1.0.2a-1).

To resolve this, I updated my version of OpenSSL to the latest:

brew update
brew upgrade openssl

Then I reinstalled Python referencing this updated version of OpenSSL:

brew uninstall python
brew install python --with-brewed-openssl

After this, I nuked by Google Cloud SDK install (because I was mucking around in there a bit to find a solution; you might not have to do this) and installed from scratch:

curl https://sdk.cloud.google.com | bash

And we're golden!

For further reading on these OpenSSL issues with OS X, check out this article: https://hynek.me/articles/apple-openssl-verification-surprises/

jemartti
  • 41
  • 1
  • 1
  • 6
1

TL;DR

  1. Locate the cacerts.txt file used by google's scripts. Should be in <google-cloud-sdk>/lib/third_party/httplib2/cacerts.txt.
  2. Open https://dl.google.com in Firefox and export its certificate(s).
  3. Copy the contents of the certificate(s) to the end of the cacerts.txt file.

You may also need to make sure your system's openssl version is the same version as the openssl that's used by python, as of jemartti's answer. I tried it and it wasn't enough. I don't know whether it's essential.

Steps taken to reach this solution

After trying jemartti's answer to no avail, I used the --verbosity debug flag in order to trace the point of failure. The output was:

DEBUG: Could not fetch [https://dl.google.com/dl/cloudsdk/channels/rapid/components-v100.0.0.json] Traceback (most recent call last): File "/usr/local/google-cloud-sdk/lib/googlecloudsdk/core/updater/snapshots.py", line 186, in _DictFromURL response = installers.ComponentInstaller.MakeRequest(url, command_path) File "/usr/local/google-cloud-sdk/lib/googlecloudsdk/core/updater/installers.py", line 277, in MakeRequest return urlopen_with_cacerts.urlopen(req, timeout=TIMEOUT_IN_SEC) File "/usr/local/google-cloud-sdk/lib/googlecloudsdk/core/util/urlopen_with_cacerts.py", line 40, in urlopen return orig_urlopen(*args, **kwargs) File "/usr/local/Cellar/python/2.7.11/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 154, in urlopen return opener.open(url, data, timeout) File "/usr/local/Cellar/python/2.7.11/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 431, in open response = self._open(req, data) File "/usr/local/Cellar/python/2.7.11/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 449, in _open '_open', req) File "/usr/local/Cellar/python/2.7.11/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 409, in _call_chain result = func(*args) File "/usr/local/Cellar/python/2.7.11/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 1240, in https_open context=self._context) File "/usr/local/Cellar/python/2.7.11/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 1197, in do_open raise URLError(err) URLError:

So I opened /usr/local/google-cloud-sdk/core/util/urlopen_with_cacerts.py and saw that it calls httplib2's urlopen method with a cafile argument obtained from httplib2.CA_CERTS. I added a line that prints that httplib2.CA_CERTS, of which output was:

/usr/local/google-cloud-sdk/lib/third_party/httplib2/cacerts.txt

Then, as described in this answer, this is why I did:

  1. Open the URL in Firefox and export the certificate(s).
  2. Copy the contents of the certificate(s) to the end of the cacerts.txt file.

As a Mac user, I also used the one-liner described here (that for some reason yielded a different certificate than Firefox's certificate-export feature), in order to save the certificate(s) on my machine (replace exmple.com and example.crt as needed):

openssl x509 -in <(openssl s_client -connect example.com:443 -prexit 2>/dev/null) -out ~/example.crt
Community
  • 1
  • 1
yair
  • 8,945
  • 4
  • 31
  • 50