Flask+Pymongo连接MongoDB时出现X509_V_FLAG_CB_ISSUER_CHECK属性错误

错误日志 #

mod_wsgi (pid=43050): Failed to exec Python script file "/myflaskapp/myflaskapp.wsgi".
mod_wsgi (pid=43050): Exception occurred processing WSGI script "/myflaskapp/myflaskapp.wsgi".
Traceback (most recent call last):
  File "/myflaskapp/myflaskapp.wsgi", line 10, in <module>
    from myflaskapp import app as application
  File "/myflaskapp/__init__.py", line 41, in <module>
    from myflaskapp import routes
  File "/myflaskapp/routes.py", line 23, in <module>
    from myflaskapp.helper import *
  File "/myflaskapp/helper.py", line 19, in <module>
    from pymongo import MongoClient
  File "/myflaskapp/myenv/lib/python3.11/site-packages/pymongo/__init__.py", line 93, in <module>
    from pymongo.mongo_client import MongoClient
  File "/myflaskapp/myenv/lib/python3.11/site-packages/pymongo/mongo_client.py", line 62, in <module>
    from pymongo import (
  File "/myflaskapp/myenv/lib/python3.11/site-packages/pymongo/uri_parser.py", line 34, in <module>
    from pymongo.client_options import _parse_ssl_options
  File "/myflaskapp/myenv/lib/python3.11/site-packages/pymongo/client_options.py", line 27, in <module>
    from pymongo.pool import PoolOptions
  File "/myflaskapp/myenv/lib/python3.11/site-packages/pymongo/pool.py", line 79, in <module>
    from pymongo.network import command, receive_message
  File "/myflaskapp/myenv/lib/python3.11/site-packages/pymongo/network.py", line 35, in <module>
    from pymongo import _csot, helpers, message, ssl_support
  File "/myflaskapp/myenv/lib/python3.11/site-packages/pymongo/ssl_support.py", line 25, in <module>
    import pymongo.pyopenssl_context as _ssl
  File "/myflaskapp/myenv/lib/python3.11/site-packages/pymongo/pyopenssl_context.py", line 29, in <module>
    from OpenSSL import SSL as _SSL
  File "/usr/lib/python3/dist-packages/OpenSSL/__init__.py", line 8, in <module>
    from OpenSSL import crypto, SSL
  File "/usr/lib/python3/dist-packages/OpenSSL/crypto.py", line 1553, in <module>
    class X509StoreFlags(object):
  File "/usr/lib/python3/dist-packages/OpenSSL/crypto.py", line 1573, in X509StoreFlags
    CB_ISSUER_CHECK = _lib.X509_V_FLAG_CB_ISSUER_CHECK
AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'

应用环境 #

• 操作系统：Ubuntu 20.04
• OpenSSL版本：OpenSSL 1.1.1f 31 Mar 2020
• Python版本：3.11.7
• pyopenssl版本：23.3.0
• pymongo版本：4.6.1
• Flask版本：3.0.1

已尝试操作 #

• 执行pip install --upgrade pymongo pyopenssl
• 参考相关技术文章，但问题未解决

解决方案 #

1. 修正mod_wsgi的Python环境指向 #

错误日志显示加载的是系统路径下的/usr/lib/python3/dist-packages/OpenSSL/，而非虚拟环境中的包，说明mod_wsgi未正确使用虚拟环境的Python解释器：

• 编辑Apache的WSGI配置文件，添加或修改以下配置：

  WSGIPythonHome /myflaskapp/myenv
  WSGIPythonPath /myflaskapp:/myflaskapp/myenv/lib/python3.11/site-packages
  

• 重启Apache服务：sudo systemctl restart apache2

2. 降级pyopenssl至兼容版本 #

Ubuntu 20.04自带的OpenSSL 1.1.1f不支持X509_V_FLAG_CB_ISSUER_CHECK属性，而pyopenssl 23.x版本依赖该属性，需降级到兼容版本：

• 激活虚拟环境：source /myflaskapp/myenv/bin/activate
• 执行降级命令：pip install pyopenssl==22.1.0

3. 强制PyMongo使用标准库SSL模块 #

通过设置环境变量，让PyMongo跳过pyopenssl，直接使用Python标准库的ssl模块：

• 在myflaskapp.wsgi文件开头添加以下代码：

  import os
  os.environ['PYMONGO_DISABLE_PYOPENSSL'] = '1'
  

• 重启Apache服务生效

内容的提问来源于stack exchange，提问作者Nishanth Shastry