Anvil App Server [SSL: CERTIFICATE_VERIFY_FAILED]

nickantonaccio · September 30, 2023, 8:28pm

What I’m trying to do:

Run anvil-app-server on Windows 11 Pro. I’ve got 2 laptops with the same version of Windows 11, both updated, with the same versions of Python and Corretto installed. Anvil app server runs on one machine (as it has on a variety of other Windows and Linux boxes), but on the 2nd laptop, when I do:

(anvil) C:\anvil>anvil-app-server --app billing

I get:

Downloading Anvil App Server JAR to package directory
…
urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1131)>

I’m currently only trying to run on localhost or on http (no https in --origin http://), but anvil-app-server doesn’t run, even if I don’t pass an --app appname.

What I’ve tried and what’s not working:

I’ve tried re-installing anvil-app-server in fresh venv environments using every version back to 1.7.3 (pip install anvil-app-server==1.7.3). Version 1.7.3 currently works with this app on other machines.

I’ve tried re-installing Python versions 3.8 to 3.11, and Corretto versions 11 and 17.

I’ve tried entirely disabling (and also re-enabling) Windows firewall, pip install --upgrade certifi, pip install --upgrade --force-reinstall certifi, looked in certmgr.msc, but not sure what to look for…

This seems to be a Python and/or Corretto issue. One relevant occurrence is that Windows firewall popped up a permission request on the machine where everything is working properly, but not on the machine where anvil-app-server isn’t running.

Code Sample:

any code example, including default todo list app, or no app at all

Clone link:

not app specific

nickantonaccio · September 30, 2023, 10:32pm

Here’s the full error:

(anvil) C:\anvil>anvil-app-server
Downloading Anvil App Server JAR to package directory
Failed to download App Server to package directory. Retrying in ~/.anvil
Traceback (most recent call last):
  File "C:\Program Files\Python311\Lib\urllib\request.py", line 1348, in do_open
    h.request(req.get_method(), req.selector, req.data, headers,
  File "C:\Program Files\Python311\Lib\http\client.py", line 1282, in request
    self._send_request(method, url, body, headers, encode_chunked)
  File "C:\Program Files\Python311\Lib\http\client.py", line 1328, in _send_request
    self.endheaders(body, encode_chunked=encode_chunked)
  File "C:\Program Files\Python311\Lib\http\client.py", line 1277, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "C:\Program Files\Python311\Lib\http\client.py", line 1037, in _send_output
    self.send(msg)
  File "C:\Program Files\Python311\Lib\http\client.py", line 975, in send
    self.connect()
  File "C:\Program Files\Python311\Lib\http\client.py", line 1454, in connect
    self.sock = self._context.wrap_socket(self.sock,
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\ssl.py", line 517, in wrap_socket
    return self.sslsocket_class._create(
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\ssl.py", line 1075, in _create
    self.do_handshake()
  File "C:\Program Files\Python311\Lib\ssl.py", line 1346, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\anvil\Lib\site-packages\anvil_app_server\__init__.py", line 177, in find_or_download_app_server
    _urlretrieve(url, package_dir_path, show_progress)
  File "C:\Program Files\Python311\Lib\urllib\request.py", line 241, in urlretrieve
    with contextlib.closing(urlopen(url, data)) as fp:
                            ^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\urllib\request.py", line 216, in urlopen
    return opener.open(url, data, timeout)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\urllib\request.py", line 519, in open
    response = self._open(req, data)
               ^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\urllib\request.py", line 536, in _open
    result = self._call_chain(self.handle_open, protocol, protocol +
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\urllib\request.py", line 496, in _call_chain
    result = func(*args)
             ^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\urllib\request.py", line 1391, in https_open
    return self.do_open(http.client.HTTPSConnection, req,
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\urllib\request.py", line 1351, in do_open
    raise URLError(err)
urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)>

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\Program Files\Python311\Lib\urllib\request.py", line 1348, in do_open
    h.request(req.get_method(), req.selector, req.data, headers,
  File "C:\Program Files\Python311\Lib\http\client.py", line 1282, in request
    self._send_request(method, url, body, headers, encode_chunked)
  File "C:\Program Files\Python311\Lib\http\client.py", line 1328, in _send_request
    self.endheaders(body, encode_chunked=encode_chunked)
  File "C:\Program Files\Python311\Lib\http\client.py", line 1277, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "C:\Program Files\Python311\Lib\http\client.py", line 1037, in _send_output
    self.send(msg)
  File "C:\Program Files\Python311\Lib\http\client.py", line 975, in send
    self.connect()
  File "C:\Program Files\Python311\Lib\http\client.py", line 1454, in connect
    self.sock = self._context.wrap_socket(self.sock,
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\ssl.py", line 517, in wrap_socket
    return self.sslsocket_class._create(
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\ssl.py", line 1075, in _create
    self.do_handshake()
  File "C:\Program Files\Python311\Lib\ssl.py", line 1346, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "C:\anvil\Scripts\anvil-app-server.exe\__main__.py", line 7, in <module>
  File "C:\anvil\Lib\site-packages\anvil_app_server\__init__.py", line 12, in launch
    jar_path = find_or_download_app_server()
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\anvil\Lib\site-packages\anvil_app_server\__init__.py", line 182, in find_or_download_app_server
    _urlretrieve(url, home_dir_path, show_progress)
  File "C:\Program Files\Python311\Lib\urllib\request.py", line 241, in urlretrieve
    with contextlib.closing(urlopen(url, data)) as fp:
                            ^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\urllib\request.py", line 216, in urlopen
    return opener.open(url, data, timeout)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\urllib\request.py", line 519, in open
    response = self._open(req, data)
               ^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\urllib\request.py", line 536, in _open
    result = self._call_chain(self.handle_open, protocol, protocol +
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\urllib\request.py", line 496, in _call_chain
    result = func(*args)
             ^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\urllib\request.py", line 1391, in https_open
    return self.do_open(http.client.HTTPSConnection, req,
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\urllib\request.py", line 1351, in do_open
    raise URLError(err)
urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)>

nickantonaccio · October 1, 2023, 11:16am

I reinstalled Windows 11 on that machine, and the SSL problem is now fixed (I’m still curious what caused it!). The jar file does now download properly, and the Windows firewall prompts do now pop up, so I thought all was good, but Anvil app server is not running:

with python 3.11.5150.0 (from python.org download site) and corretto 11 installed:

anvil-app-server --app billing --origin http://192.168.12.85
Downloading Anvil App Server JAR to package directory
100% of 320.5 MiB |##############################################################| Elapsed Time: 0:00:12 Time: 0:00:12
Downloaded Anvil App Server JAR to package directory
Failed to start built-in Postgres database: java.lang.IllegalStateException: Missing embedded postgres binaries
More logs are available in .anvil-data\postgres.log.
Some common causes of this problem:

Are you launching this server as ‘root’ on a UNIX system?
Postgres will not run as root; try launching the server as an ordinary user.
Are you running this server on an unusual architecture or OS? (Windows 11/x86)

with corretto 17 installed:

anvil-app-server --app billing
Found Anvil App Server JAR in package directory
Failed to start built-in Postgres database: java.lang.IllegalStateException: Process [.anvil-data\db-bin\PG-3ecc125de4870fe95f7f29f11aba3613\bin\initdb.exe, -A, trust, -U, postgres, -D, .anvil-data\db, -E, UTF-8] failed
More logs are available in .anvil-data\postgres.log.
Some common causes of this problem:

Are you launching this server as ‘root’ on a UNIX system?
Postgres will not run as root; try launching the server as an ordinary user.
Are you running this server on an unusual architecture or OS? (Windows 11/amd64)

with python 11 installed from Windows store and corretto 20 installed:

(python-from-store) C:\python-from-store>anvil-app-server --app billing
Found Anvil App Server JAR in package directory
Failed to start built-in Postgres database: java.lang.IllegalStateException: Process [.anvil-data\db-bin\PG-3ecc125de4870fe95f7f29f11aba3613\bin\initdb.exe, -A, trust, -U, postgres, -D, .anvil-data\db, -E, UTF-8] failed
More logs are available in .anvil-data\postgres.log.
Some common causes of this problem:

Are you launching this server as ‘root’ on a UNIX system?
Postgres will not run as root; try launching the server as an ordinary user.
Are you running this server on an unusual architecture or OS? (Windows 11/amd64)

I tried creating and running the default MyTodoList app:

(python-from-store) C:\python-from-store>create-anvil-app todo-list MyTodoList

Congratulations! Your new Anvil app is created, using the ‘todo-list’
template. To serve this app, run:

anvil-app-server --app MyTodoList

(python-from-store) C:\python-from-store>anvil-app-server --app MyTodoList
Found Anvil App Server JAR in package directory
Failed to start built-in Postgres database: java.lang.IllegalStateException: Process [.anvil-data\db-bin\PG-3ecc125de4870fe95f7f29f11aba3613\bin\initdb.exe, -A, trust, -U, postgres, -D, .anvil-data\db, -E, UTF-8] failed
More logs are available in .anvil-data\postgres.log.
Some common causes of this problem:

Are you launching this server as ‘root’ on a UNIX system?
Postgres will not run as root; try launching the server as an ordinary user.

nickantonaccio · October 1, 2023, 11:48am

And I still get this error with Corretto 11:

(python-from-store) C:\python-from-store>anvil-app-server --app billing
Found Anvil App Server JAR in package directory
Failed to start built-in Postgres database: java.lang.IllegalStateException: Missing embedded postgres binaries
More logs are available in .anvil-data\postgres.log.
Some common causes of this problem:

Are you launching this server as ‘root’ on a UNIX system?
Postgres will not run as root; try launching the server as an ordinary user.
Are you running this server on an unusual architecture or OS? (Windows 11/x86)

nickantonaccio · October 1, 2023, 2:20pm

Oops, that last error was because I managed to download the x86 version of Corretto 11.

I tried with Eclipse Temurin 21 from adoptium.net and received the same error:

(python-from-store) C:\python-from-store>anvil-app-server --app billing
Found Anvil App Server JAR in package directory
Failed to start built-in Postgres database: java.lang.IllegalStateException: Process [.anvil-data\db-bin\PG-3ecc125de4870fe95f7f29f11aba3613\bin\initdb.exe, -A, trust, -U, postgres, -D, .anvil-data\db, -E, UTF-8] failed

More logs are available in .anvil-data\postgres.log.
Some common causes of this problem:

Are you launching this server as ‘root’ on a UNIX system?
Postgres will not run as root; try launching the server as an ordinary user.
Are you running this server on an unusual architecture or OS? (Windows 11/amd64)

The postgres.log and postgres.err files have no content. The postgres-embedding.log content is below:

[INFO io.zonky.test.db.postgres.embedded.EmbeddedPostgres] Detected a Windows x86_64 system
[INFO io.zonky.test.db.postgres.embedded.DefaultPostgresBinaryResolver] Detected distribution: ‘Unknown’
[TRACE io.zonky.test.db.postgres.embedded.DefaultPostgresBinaryResolver] Searching for postgres binaries - location: ‘postgres-windows-x86_64.txz’
[INFO io.zonky.test.db.postgres.embedded.DefaultPostgresBinaryResolver] System specific postgres binaries found: ‘postgres-windows-x86_64.txz’
[INFO io.zonky.test.db.postgres.embedded.EmbeddedPostgres] Postgres binaries at .anvil-data\db-bin\PG-3ecc125de4870fe95f7f29f11aba3613
[TRACE io.zonky.test.db.postgres.embedded.EmbeddedPostgres] 44797e0c-65be-451d-9785-5747ea90bba0 postgres data directory is .anvil-data\db

nickantonaccio · October 1, 2023, 2:27pm

Hmm, if I run C:\python-from-store.anvil-data\db-bin\PG-3ecc125de4870fe95f7f29f11aba3613\bin>initdb.exe , I get a missing dll notice:

msvcr120

nickantonaccio · October 1, 2023, 2:34pm

To satisfy the MSVCR120.dll requirement, I installed the Visual Studio 2013 (VC++ 12.0) Visual C++ redistributable from Latest supported Visual C++ Redistributable downloads | Microsoft Learn

Yeehaw, it’s working

nickantonaccio · October 1, 2023, 2:45pm

I still would like to know how to resolve the initial SSL issue (not being able to download the jar file) I ran into, without having to re-install Windows 11… Does anyone know how to use the jar file from an existing installation? I tried copying just the jar file, but it just hung for 10 seconds and wouldn’t run. What other files are needed along with the jar file (or should copying that jar file work if all the other anvil-app-server requirements are met)?

tobias.carlbom · December 16, 2024, 5:17pm

I also got this error in my windows server 2019.

I manage to solve it by adding the following environment variable.

But before i added this i ran:

pip install --upgrade certifi

python -m certifi

Output: C:\Program Files\Python313\Lib\site-packages\certifi\cacert.pem

nickantonaccio · December 17, 2024, 2:03am

Thank you, I’ll give that a try!