SSLCertVerificationError error when trying to download model presets from kaggle.com

[davidshen84]

Hi,

I ran this code in a notebook hosted on my laptop:

keras_nlp.models.GemmaCausalLM.from_preset("albert_base_en_uncased")

But got the following error:

SSLCertVerificationError

Downloading from https://www.kaggle.com/api/v1/models/keras/albert/keras/albert_base_en_uncased/2/download/config.json...
---------------------------------------------------------------------------
SSLCertVerificationError                  Traceback (most recent call last)
File /usr/local/lib/python3.11/dist-packages/urllib3/connectionpool.py:467, in HTTPConnectionPool._make_request(self, conn, method, url, body, headers, retries, timeout, chunked, response_conn, preload_content, decode_content, enforce_content_length)
    466 try:
--> 467     self._validate_conn(conn)
    468 except (SocketTimeout, BaseSSLError) as e:

File /usr/local/lib/python3.11/dist-packages/urllib3/connectionpool.py:1099, in HTTPSConnectionPool._validate_conn(self, conn)
   1098 if conn.is_closed:
-> 1099     conn.connect()
   1101 # TODO revise this, see https://github.com/urllib3/urllib3/issues/2791

File /usr/local/lib/python3.11/dist-packages/urllib3/connection.py:653, in HTTPSConnection.connect(self)
    651 server_hostname_rm_dot = server_hostname.rstrip(".")
--> 653 sock_and_verified = _ssl_wrap_socket_and_match_hostname(
    654     sock=sock,
    655     cert_reqs=self.cert_reqs,
    656     ssl_version=self.ssl_version,
    657     ssl_minimum_version=self.ssl_minimum_version,
    658     ssl_maximum_version=self.ssl_maximum_version,
    659     ca_certs=self.ca_certs,
    660     ca_cert_dir=self.ca_cert_dir,
    661     ca_cert_data=self.ca_cert_data,
    662     cert_file=self.cert_file,
    663     key_file=self.key_file,
    664     key_password=self.key_password,
    665     server_hostname=server_hostname_rm_dot,
    666     ssl_context=self.ssl_context,
    667     tls_in_tls=tls_in_tls,
    668     assert_hostname=self.assert_hostname,
    669     assert_fingerprint=self.assert_fingerprint,
    670 )
    671 self.sock = sock_and_verified.socket

File /usr/local/lib/python3.11/dist-packages/urllib3/connection.py:806, in _ssl_wrap_socket_and_match_hostname(sock, cert_reqs, ssl_version, ssl_minimum_version, ssl_maximum_version, cert_file, key_file, key_password, ca_certs, ca_cert_dir, ca_cert_data, assert_hostname, assert_fingerprint, server_hostname, ssl_context, tls_in_tls)
    804         server_hostname = normalized
--> 806 ssl_sock = ssl_wrap_socket(
    807     sock=sock,
    808     keyfile=key_file,
    809     certfile=cert_file,
    810     key_password=key_password,
    811     ca_certs=ca_certs,
    812     ca_cert_dir=ca_cert_dir,
    813     ca_cert_data=ca_cert_data,
    814     server_hostname=server_hostname,
    815     ssl_context=context,
    816     tls_in_tls=tls_in_tls,
    817 )
    819 try:

File /usr/local/lib/python3.11/dist-packages/urllib3/util/ssl_.py:465, in ssl_wrap_socket(sock, keyfile, certfile, cert_reqs, ca_certs, server_hostname, ssl_version, ciphers, ssl_context, ca_cert_dir, key_password, ca_cert_data, tls_in_tls)
    463     pass
--> 465 ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
    466 return ssl_sock

File /usr/local/lib/python3.11/dist-packages/urllib3/util/ssl_.py:509, in _ssl_wrap_socket_impl(sock, ssl_context, tls_in_tls, server_hostname)
    507     return SSLTransport(sock, ssl_context, server_hostname)
--> 509 return ssl_context.wrap_socket(sock, server_hostname=server_hostname)

File /usr/lib/python3.11/ssl.py:517, in SSLContext.wrap_socket(self, sock, server_side, do_handshake_on_connect, suppress_ragged_eofs, server_hostname, session)
    511 def wrap_socket(self, sock, server_side=False,
    512                 do_handshake_on_connect=True,
    513                 suppress_ragged_eofs=True,
    514                 server_hostname=None, session=None):
    515     # SSLSocket class handles server_hostname encoding before it calls
    516     # ctx._wrap_socket()
--> 517     return self.sslsocket_class._create(
    518         sock=sock,
    519         server_side=server_side,
    520         do_handshake_on_connect=do_handshake_on_connect,
    521         suppress_ragged_eofs=suppress_ragged_eofs,
    522         server_hostname=server_hostname,
    523         context=self,
    524         session=session
    525     )

File /usr/lib/python3.11/ssl.py:1075, in SSLSocket._create(cls, sock, server_side, do_handshake_on_connect, suppress_ragged_eofs, server_hostname, context, session)
   1074             raise ValueError("do_handshake_on_connect should not be specified for non-blocking sockets")
-> 1075         self.do_handshake()
   1076 except (OSError, ValueError):

File /usr/lib/python3.11/ssl.py:1346, in SSLSocket.do_handshake(self, block)
   1345         self.settimeout(None)
-> 1346     self._sslobj.do_handshake()
   1347 finally:

SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)

During handling of the above exception, another exception occurred:

SSLError                                  Traceback (most recent call last)
File /usr/local/lib/python3.11/dist-packages/urllib3/connectionpool.py:793, in HTTPConnectionPool.urlopen(self, method, url, body, headers, retries, redirect, assert_same_host, timeout, pool_timeout, release_conn, chunked, body_pos, preload_content, decode_content, **response_kw)
    792 # Make the request on the HTTPConnection object
--> 793 response = self._make_request(
    794     conn,
    795     method,
    796     url,
    797     timeout=timeout_obj,
    798     body=body,
    799     headers=headers,
    800     chunked=chunked,
    801     retries=retries,
    802     response_conn=response_conn,
    803     preload_content=preload_content,
    804     decode_content=decode_content,
    805     **response_kw,
    806 )
    808 # Everything went great!

File /usr/local/lib/python3.11/dist-packages/urllib3/connectionpool.py:491, in HTTPConnectionPool._make_request(self, conn, method, url, body, headers, retries, timeout, chunked, response_conn, preload_content, decode_content, enforce_content_length)
    490         new_e = _wrap_proxy_error(new_e, conn.proxy.scheme)
--> 491     raise new_e
    493 # conn.request() calls http.client.*.request, not the method in
    494 # urllib3.request. It also calls makefile (recv) on the socket.

SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)

The above exception was the direct cause of the following exception:

MaxRetryError                             Traceback (most recent call last)
File /usr/local/lib/python3.11/dist-packages/requests/adapters.py:486, in HTTPAdapter.send(self, request, stream, timeout, verify, cert, proxies)
    485 try:
--> 486     resp = conn.urlopen(
    487         method=request.method,
    488         url=url,
    489         body=request.body,
    490         headers=request.headers,
    491         redirect=False,
    492         assert_same_host=False,
    493         preload_content=False,
    494         decode_content=False,
    495         retries=self.max_retries,
    496         timeout=timeout,
    497         chunked=chunked,
    498     )
    500 except (ProtocolError, OSError) as err:

File /usr/local/lib/python3.11/dist-packages/urllib3/connectionpool.py:847, in HTTPConnectionPool.urlopen(self, method, url, body, headers, retries, redirect, assert_same_host, timeout, pool_timeout, release_conn, chunked, body_pos, preload_content, decode_content, **response_kw)
    845     new_e = ProtocolError("Connection aborted.", new_e)
--> 847 retries = retries.increment(
    848     method, url, error=new_e, _pool=self, _stacktrace=sys.exc_info()[2]
    849 )
    850 retries.sleep()

File /usr/local/lib/python3.11/dist-packages/urllib3/util/retry.py:515, in Retry.increment(self, method, url, response, error, _pool, _stacktrace)
    514     reason = error or ResponseError(cause)
--> 515     raise MaxRetryError(_pool, url, reason) from reason  # type: ignore[arg-type]
    517 log.debug("Incremented Retry for (url='%s'): %r", url, new_retry)

MaxRetryError: HTTPSConnectionPool(host='[www.kaggle.com](https://www.kaggle.com/)', port=443): Max retries exceeded with url: /api/v1/models/keras/albert/keras/albert_base_en_uncased/2/download/config.json (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)')))

During handling of the above exception, another exception occurred:

SSLError                                  Traceback (most recent call last)
Cell In[3], line 1
----> 1 gemma_lm = keras_nlp.models.GemmaCausalLM.from_preset("albert_base_en_uncased")

File /usr/local/lib/python3.11/dist-packages/keras_nlp/src/models/task.py:220, in Task.from_preset(cls, preset, load_weights, **kwargs)
    213 if "backbone" in kwargs:
    214     raise ValueError(
    215         "You cannot pass a `backbone` argument to the `from_preset` "
    216         f"method. Instead, call the {cls.__name__} default "
    217         "constructor with a `backbone` argument. "
    218         f"Received: backbone={kwargs['backbone']}."
    219     )
--> 220 preset_cls = check_config_class(preset)
    222 # Backbone case.
    223 if issubclass(preset_cls, Backbone):

File /usr/local/lib/python3.11/dist-packages/keras_nlp/src/utils/preset_utils.py:408, in check_config_class(preset, config_file)
    403 def check_config_class(
    404     preset,
    405     config_file="config.json",
    406 ):
    407     """Validate a preset is being loaded on the correct class."""
--> 408     config_path = get_file(preset, config_file)
    409     with open(config_path) as config_file:
    410         config = json.load(config_file)

File /usr/local/lib/python3.11/dist-packages/keras_nlp/src/utils/preset_utils.py:102, in get_file(preset, path)
     94     if num_segments not in (4, 5):
     95         raise ValueError(
     96             "Unexpected Kaggle preset. Kaggle model handles should have "
     97             "the form kaggle://{org}/{model}/keras/{variant}[/{version}]. "
   (...)
    100             f"version). Received: preset={preset}"
    101         )
--> 102     return kagglehub.model_download(kaggle_handle, path)
    103 elif preset.startswith(GS_PREFIX):
    104     url = os.path.join(preset, path)

File /usr/local/lib/python3.11/dist-packages/kagglehub/models.py:25, in model_download(handle, path, force_download)
     13 """Download model files.
     14 
     15 Args:
   (...)
     22     A string representing the path to the requested model files.
     23 """
     24 h = parse_model_handle(handle)
---> 25 return registry.model_resolver(h, path, force_download=force_download)

File /usr/local/lib/python3.11/dist-packages/kagglehub/registry.py:23, in MultiImplRegistry.__call__(self, *args, **kwargs)
     21 for impl in reversed(self._impls):
     22     if impl.is_supported(*args, **kwargs):
---> 23         return impl(*args, **kwargs)
     24     else:
     25         fails.append(type(impl).__name__)

File /usr/local/lib/python3.11/dist-packages/kagglehub/http_resolver.py:46, in ModelHttpResolver.__call__(self, h, path, force_download)
     43 if path:
     44     # Downloading a single file.
     45     os.makedirs(os.path.dirname(out_path), exist_ok=True)
---> 46     api_client.download_file(url_path + "/" + path, out_path, h)
     47 else:
     48     # Downloading the full archived bundle.
     49     archive_path = get_cached_archive_path(h)

File /usr/local/lib/python3.11/dist-packages/kagglehub/clients.py:129, in KaggleApiV1Client.download_file(self, path, out_file, resource_handle)
    127 url = self._build_url(path)
    128 logger.info(f"Downloading from {url}...")
--> 129 with requests.get(
    130     url,
    131     headers={"User-Agent": get_user_agent()},
    132     stream=True,
    133     auth=self._get_http_basic_auth(),
    134     timeout=(DEFAULT_CONNECT_TIMEOUT, DEFAULT_READ_TIMEOUT),
    135 ) as response:
    136     kaggle_api_raise_for_status(response, resource_handle)
    137     total_size = int(response.headers["Content-Length"])

File /usr/local/lib/python3.11/dist-packages/requests/api.py:73, in get(url, params, **kwargs)
     62 def get(url, params=None, **kwargs):
     63     r"""Sends a GET request.
     64 
     65     :param url: URL for the new :class:`Request` object.
   (...)
     70     :rtype: requests.Response
     71     """
---> 73     return request("get", url, params=params, **kwargs)

File /usr/local/lib/python3.11/dist-packages/requests/api.py:59, in request(method, url, **kwargs)
     55 # By using the 'with' statement we are sure the session is closed, thus we
     56 # avoid leaving sockets open which can trigger a ResourceWarning in some
     57 # cases, and look like a memory leak in others.
     58 with sessions.Session() as session:
---> 59     return session.request(method=method, url=url, **kwargs)

File /usr/local/lib/python3.11/dist-packages/requests/sessions.py:589, in Session.request(self, method, url, params, data, headers, cookies, files, auth, timeout, allow_redirects, proxies, hooks, stream, verify, cert, json)
    584 send_kwargs = {
    585     "timeout": timeout,
    586     "allow_redirects": allow_redirects,
    587 }
    588 send_kwargs.update(settings)
--> 589 resp = self.send(prep, **send_kwargs)
    591 return resp

File /usr/local/lib/python3.11/dist-packages/requests/sessions.py:703, in Session.send(self, request, **kwargs)
    700 start = preferred_clock()
    702 # Send the request
--> 703 r = adapter.send(request, **kwargs)
    705 # Total elapsed time of the request (approximately)
    706 elapsed = preferred_clock() - start

File /usr/local/lib/python3.11/dist-packages/requests/adapters.py:517, in HTTPAdapter.send(self, request, stream, timeout, verify, cert, proxies)
    513         raise ProxyError(e, request=request)
    515     if isinstance(e.reason, _SSLError):
    516         # This branch is for urllib3 v1.22 and later.
--> 517         raise SSLError(e, request=request)
    519     raise ConnectionError(e, request=request)
    521 except ClosedPoolError as e:

SSLError: HTTPSConnectionPool(host='[www.kaggle.com](https://www.kaggle.com/)', port=443): Max retries exceeded with url: /api/v1/models/keras/albert/keras/albert_base_en_uncased/2/download/config.json (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)')))

It looks like we are using the urllib3 to fetch data. However, I tried to use urllib3 directly and I can access kaggle.com in the same notebook.

import urllib3

urllib3.request("GET", url="https://www.kaggle.com/api/v1/models/keras/albert/keras/albert_base_en_uncased/2/download/config.json").data

The only environmental issue I can think of is that I am behind a company firewall. But if urllib3 works when using directly, how can it failed to fetch data when used inside keras?

Did keras tried to modify the certificate configuration? Is there a way for me to override it?

[davidshen84]

nvm...I should configure the requests lib.

Interestingly, setting the REQUESTS_CA_BUNDLE or the CURL_CA_BUNDLE environment variable values to an empty string won't disable SSL verification. I have to set it to a correct certificate path on my system to resolve this error.