macOS 12.4更新Command Line Tools后gcloud报SSL证书验证失败

• 运行环境：macOS 12.4，更新Xcode Command Line Tools至13.4版本后，执行gcloud compute ssh时抛出SSL证书校验错误，错误信息为[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate，命令无法正常执行
• 当前网络未配置代理、防火墙规则
• 已尝试以下操作均未修复问题：
  • 更新、重装、多次彻底卸载后全新安装Google Cloud SDK，执行gcloud init时仍报相同错误，无法完成初始化
  • 将Xcode Command Line Tools降级至13.2版本
  • 更新certifi库、运行Install Certificates.command脚本

诊断信息 #

gcloud info --run-diagnostics --verbosity debug 执行输出 #

DEBUG: Running [gcloud.info] with arguments: [--run-diagnostics: "True", --verbosity: "debug"]
Network diagnostic detects and fixes local network connection issues.
Checking network connection...⠏DEBUG: Starting new HTTPS connection (1): accounts.google.com:443
Checking network connection...⠛DEBUG: https://accounts.google.com:443 "GET / HTTP/1.1" 302 338
Checking network connection...⠹DEBUG: https://accounts.google.com:443 "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1" 302 526
DEBUG: https://accounts.google.com:443 "GET /v3/signin/identifier?dsh=S352504070%3A1656098809680794&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&ifkv=AX3vH3-l3sW9otbTScMC6LItjgqZXIpEl6jaKQLX4a-o3Z7M4L5oVPqMq_V_Vltgjce-HlGz4y0mFQ HTTP/1.1" 200 None
Checking network connection...⠼DEBUG: Starting new HTTPS connection (1): cloudresourcemanager.googleapis.com:443
DEBUG: Starting new HTTPS connection (1): www.googleapis.com:443
Checking network connection...⠶DEBUG: Starting new HTTPS connection (1): dl.google.com:443
Checking network connection...⠧DEBUG: https://dl.google.com:443 "GET /dl/cloudsdk/channels/rapid/components-2.json HTTP/1.1" 200 190919
Checking network connection...done.
ERROR: Reachability Check failed.
    httplib2 cannot reach https://cloudresourcemanager.googleapis.com/v1beta1/projects:
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1091)

    httplib2 cannot reach https://www.googleapis.com/auth/cloud-platform:
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1091)

    requests cannot reach https://cloudresourcemanager.googleapis.com/v1beta1/projects:
HTTPSConnectionPool(host='cloudresourcemanager.googleapis.com', port=443): Max retries exceeded with url: /v1beta1/projects (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1091)')))

    requests cannot reach https://www.googleapis.com/auth/cloud-platform:
HTTPSConnectionPool(host='www.googleapis.com', port=443): Max retries exceeded with url: /auth/cloud-platform (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1091)')))

Network connection problems may be due to proxy or firewall settings.


Do you have a network proxy you would like to set in gcloud (Y/n)?  n

ERROR: Network diagnostic failed (0/1 checks passed).

Property diagnostic detects issues that may be caused by properties.
Checking hidden properties...done.
Hidden Property Check passed.
Property diagnostic passed (1/1 checks passed).

DEBUG: (gcloud.info) Some of the checks in diagnostics failed.
Traceback (most recent call last):
  File "/Users/gclouder/google-cloud-sdk/lib/googlecloudsdk/calliope/cli.py", line 987, in Execute
    resources = calliope_command.Run(cli=self, args=args)
  File "/Users/gclouder/google-cloud-sdk/lib/googlecloudsdk/calliope/backend.py", line 809, in Run
    resources = command_instance.Run(args)
  File "/Users/gclouder/google-cloud-sdk/lib/surface/info.py", line 91, in Run
    raise exceptions.Error('Some of the checks in diagnostics failed.')
googlecloudsdk.core.exceptions.Error: Some of the checks in diagnostics failed.
ERROR: (gcloud.info) Some of the checks in diagnostics failed.

gcloud info 执行输出 #

Google Cloud SDK [391.0.0]

Platform: [Mac OS X, x86_64] uname_result(system='Darwin', node='gclouder.local', release='21.5.0', version='Darwin Kernel Version 21.5.0: Tue Apr 26 21:08:22 PDT 2022; root:xnu-8020.121.3~4/RELEASE_X86_64', machine='x86_64', processor='i386')
Locale: (None, 'UTF-8')
Python Version: [3.7.9 (v3.7.9:13c94747c7, Aug 15 2020, 01:31:08)  [Clang 6.0 (clang-600.0.57)]]
Python Location: [/Users/gclouder/.config/gcloud/virtenv/bin/python3]
OpenSSL: [OpenSSL 1.1.1g  21 Apr 2020]
Requests Version: [2.22.0]
urllib3 Version: [1.25.9]
Site Packages: [Enabled]

Installation Root: [/Users/gclouder/google-cloud-sdk]
Installed Components:
  gsutil: [5.10]
  core: [2022.06.17]
  bq: [2.0.75]
System PATH: [/Users/gclouder/.config/gcloud/virtenv/bin:/Users/gclouder/google-cloud-sdk/bin:/Users/gclouder/.nvm/versions/node/v14.19.0/bin:/Users/gclouder/.jenv/shims:/Users/gclouder/.jenv/bin:/usr/local/opt/mysql@5.7/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin]
Python PATH: [/Users/gclouder/google-cloud-sdk/lib/third_party:/Users/gclouder/google-cloud-sdk/lib:/Library/Frameworks/Python.framework/Versions/3.7/lib/python37.zip:/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7:/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/lib-dynload:/Users/gclouder/.config/gcloud/virtenv/lib/python3.7/site-packages]
Cloud SDK on PATH: [True]
Kubectl on PATH: [/usr/local/bin/kubectl]

Installation Properties: [/Users/gclouder/google-cloud-sdk/properties]
User Config Directory: [/Users/gclouder/.config/gcloud]
Active Configuration Name: [default]
Active Configuration Path: [/Users/gclouder/.config/gcloud/configurations/config_default]

Account: [None]
Project: [None]

Current Properties:
  [core]
    disable_usage_reporting: [True] (property file)

Logs Directory: [/Users/gclouder/.config/gcloud/logs]
Last Log File: [/Users/gclouder/.config/gcloud/logs/2022.06.24/21.26.47.993939.log]

git: [git version 2.32.1 (Apple Git-133)]
ssh: [OpenSSH_8.6p1, LibreSSL 3.3.6]

从诊断信息看，accounts.google.com、dl.google.com可正常访问，仅Google API域名证书校验失败，根源是gcloud自带Python虚拟环境的CA证书路径未正确指向macOS系统根证书存储，按以下顺序操作即可修复：

1. 强制gcloud使用系统根证书
   如果当前还能执行gcloud配置命令，直接运行：

   gcloud config set core/custom_ca_certs_file /etc/ssl/cert.pem
   

   如果执行上述命令也报SSL错误，直接编辑用户配置文件 ~/.config/gcloud/configurations/config_default，在[core]段落下添加配置项：

   custom_ca_certs_file = /etc/ssl/cert.pem
   

2. 重建gcloud自带Python虚拟环境
   Xcode Command Line Tools更新后会替换系统Python编译依赖，旧虚拟环境内的OpenSSL动态链接会失效，直接删除旧虚拟环境：

   rm -rf ~/.config/gcloud/virtenv
   

   执行任意gcloud命令（比如gcloud version），gcloud会自动重新创建适配当前系统环境的虚拟环境。
3. 修复虚拟环境内certifi证书映射
   激活gcloud新建的虚拟环境，重新安装certifi并将其证书路径链接到系统根证书：

   source ~/.config/gcloud/virtenv/bin/activate
   pip uninstall -y certifi
   pip install certifi
   ln -sf /etc/ssl/cert.pem $(python -m certifi.where())
   deactivate
   

4. 清除缓存重新初始化

   rm -rf ~/.config/gcloud/.ca_certs ~/.config/gcloud/logs
   gcloud init
   

如果以上步骤执行完仍报错，打开「钥匙串访问」应用，选择左侧「系统根证书」分类，确认GTS Root R1、GlobalSign Root CA两个根证书状态为「始终信任」，如果状态异常，右键修改信任设置后重启终端即可。

内容的提问来源于stack exchange，提问作者Gclouder