129

So recently I had to reinstall python due to corrupt executable. This made one of our python scripts bomb with the following error:

AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'

The line of code that caused it to bomb was:

from apiclient.discovery import build

I tried pip uninstalling and pip upgrading the google-api-python-client but I cant seem to find any information on this particular error.

For what it is worth - I am trying to pull google analytics info down via API call.

here is an output of the command prompt error

  File "C:\Analytics\Puritan_GoogleAnalytics\Google_Conversions\mcfTest.py", line 1, in <module>
    from apiclient.discovery import build
  File "C:\ProgramData\Anaconda3\lib\site-packages\apiclient\__init__.py", line 3, in <module>
    from googleapiclient import channel, discovery, errors, http, mimeparse, model
  File "C:\ProgramData\Anaconda3\lib\site-packages\googleapiclient\discovery.py", line 57, in <module>
    from googleapiclient import _auth, mimeparse
  File "C:\ProgramData\Anaconda3\lib\site-packages\googleapiclient\_auth.py", line 34, in <module>
    import oauth2client.client
  File "C:\ProgramData\Anaconda3\lib\site-packages\oauth2client\client.py", line 45, in <module>
    from oauth2client import crypt
  File "C:\ProgramData\Anaconda3\lib\site-packages\oauth2client\crypt.py", line 45, in <module>
    from oauth2client import _openssl_crypt
  File "C:\ProgramData\Anaconda3\lib\site-packages\oauth2client\_openssl_crypt.py", line 16, in <module>
    from OpenSSL import crypto
  File "C:\ProgramData\Anaconda3\lib\site-packages\OpenSSL\__init__.py", line 8, in <module>
    from OpenSSL import crypto, SSL
  File "C:\ProgramData\Anaconda3\lib\site-packages\OpenSSL\crypto.py", line 1517, in <module>
    class X509StoreFlags(object):
  File "C:\ProgramData\Anaconda3\lib\site-packages\OpenSSL\crypto.py", line 1537, in X509StoreFlags
    CB_ISSUER_CHECK = _lib.X509_V_FLAG_CB_ISSUER_CHECK
AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'
4
  • 1
    Have you followed Google analytics python quickstart? for service accounts? or QuickStart python for installed app Sep 23, 2022 at 16:23
  • @Daimto I did in fact. My posting here was to see if someone had an idea of what packages I could verify if there were version differences I was fighting with. I at least assume thats the issue based on my small research since this happened.
    – Doug Coats
    Sep 23, 2022 at 16:27
  • 1
    X509 implies to me that you are still using the p12 certificate for the service account instead of the json key file for the service account. If that is infact true. Then i would advice you to fix the code so you are using the json key file instead of the p12 file. "Its just easer and causes less errors" Sep 23, 2022 at 17:05
  • 1
    @Daimto I am using the json file. After a few trials and error I did find that the error was due to conflicting cryptography versions. I was able to get it up and running. Woohoo!
    – Doug Coats
    Sep 23, 2022 at 17:10

19 Answers 19

197

Edit the crypto.py file mentioned in the stacktrace and remove the offending line by commenting it out with a #

Then upgrade latest version of PyOpenSSL.

pip install pip --upgrade
pip install pyopenssl --upgrade

Now you can re-add the commented line again and it should be working

15
  • 23
    If you are like me, be sure not to read over this part: "Edit the crypto.py file and remove the offending line by commenting it out with a #"
    – sgdesmet
    Oct 21, 2022 at 15:30
  • 1
    Sorry it took so long to give you the deserved feedback. thanks!
    – Doug Coats
    Nov 3, 2022 at 14:59
  • 4
    @JamesDraper just check the stacktrace and you should see the path to the crypto.py Nov 11, 2022 at 13:03
  • 30
    I found it better to remove OpenSSL package entirely: rm -rf <path_to_lib_python3.7>/site-packages/OpenSSL and then doing pip install -U pyopenssl Nov 16, 2022 at 1:03
  • 4
    Yeah not clear on where that file is. What OP should have said is "After encountering this error, look at the trace back report (The error message displayed) at the very bottom it should show the file path" like this ` File "/usr/lib/python3/dist-packages/OpenSSL/crypto.py", line 3126, in <module>` or if you need to you can try and find it like this sudo find / -name "crypto.py" -type f 2>/dev/null. Also after doing this it does not fix the issue for me.
    – Dave
    Jan 17 at 14:00
117

As all the above failed for me i used the trick here: https://askubuntu.com/a/1433089/497392

sudo apt remove python3-pip 
wget https://bootstrap.pypa.io/get-pip.py
sudo python3 get-pip.py

And then after a reboot:

pip install pyopenssl --upgrade
7
  • 6
    Logged in just to upvote you! Thanks Nov 17, 2022 at 3:15
  • 4
    This is the only thing that worked for me as well; Ubuntu 20
    – elkd
    Dec 20, 2022 at 12:22
  • WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: pip.pypa.io/warnings/venv
    – Rebroad
    Dec 31, 2022 at 9:18
  • Works like a charm, this saved us so much time, thank you so much! Jul 23 at 10:32
  • Had to login to upvote thanks! Aug 2 at 21:21
55

I also encountered this error while installing Flask and firebase-admin on Ubuntu 20.04. The following commands solved my problem. First I removed OpenSSL using this command.

sudo rm -rf /usr/lib/python3/dist-packages/OpenSSL
sudo pip3 install pyopenssl
sudo pip3 install pyopenssl --upgrade
3
  • 6
    This solution worked for me, while other answers did not. Mar 6 at 17:35
  • Just need to replace the path for OpenSSL folder to the one on your file system. In my case, it was inside- /Users/<user>/anaconda3/lib/python3.7/site-packages/OpenSSL Mar 16 at 2:51
  • This fixed it, thank you! One extra note, if you're using venv, you'd want to delete the OpenSSL directory from <project directory>/venv/lib/python<version>/site-packages/OpenSSL rather than /usr/lib.
    – mire
    May 11 at 16:55
31
pip3 install pyOpenSSL --upgrade

solved all my issues.

1
  • 6
    When I tried this, I got an exception backtrace: CB_ISSUER_CHECK = _lib.X509_V_FLAG_CB_ISSUER_CHECK AttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK' Which is what we are trying to solve. Mar 6 at 17:22
18
sudo apt remove python3-openssl
3
  • 1
    Hey mtwebster, thank you for your answer! The community would appreciate if you would provide more context to your answer -- for example, how exactly python3-openssl package might be related to the problems described in the question, and how it's uninstallation can help with it. Also, while it's clear from the question that the author uses Windows environment, so your answer is probably not helpful to them, I appreciate it can be useful to Linux users (whom distributives are APT-based), if it would be more elaborate in explaining what the issue is and why it can be addressed this way.
    – mingaleg
    Feb 6 at 21:41
  • This does work to fix the broken package situation where pip commands give the original error. Mar 6 at 17:26
  • this did help resolve the error, but as @mingaleg suggested, whats the reason behind this? how does uninstalling python3-openssl get around this issue?
    – ades
    May 5 at 15:39
10

on my ubuntu "20.04.5" I manage solving the error:

CB_ISSUER_CHECK = _lib.X509_V_FLAG_CB_ISSUER_CHECK\r

by re-installing the following packages:

apt-get --reinstall install python-apt
apt-get --reinstall install apt-transport-https
apt-get install build-essential libssl-dev libffi-dev python-dev

I do not use pip as I received this error message using ansible playbook and wasn't able to reach the servers anymore.

Hope it helps somebody on day.

4
  • After re-installation I needed to upgrade pyOpenSSL and cryptography as in answer by @Robin Sving and it worked
    – Liz
    Oct 17, 2022 at 20:12
  • This is more likely for python2
    – Y Y
    Dec 22, 2022 at 15:11
  • python-dev wasn't a package
    – Rebroad
    Dec 31, 2022 at 9:20
  • This will downgrade from python-is-python3 to python 2. Not a great option.
    – Jon Watte
    Sep 15 at 21:16
10

For me, earlier answers can't help me as I meet this problem for all pip commands, even pip3 -V. But I solved it by:

  1. Get url from https://pypi.org/project/pyOpenSSL/#files , if you need the latest version.

    wget https://files.pythonhosted.org/packages/00/3f/ea5cfb789dddb327e6d2cf9377c36d9d8607af85530af0e7001165587ae7/pyOpenSSL-22.1.0-py3-none-any.whl
    
  2. Install pyOpenSSL from whl file.

    python3 -m easy_install pyOpenSSL-22.1.0-py3-none-any.whl
    

Thanks https://askubuntu.com/a/1429674

3
  • 2
    Please try the "sort by" feature of StackOverflow and reconsider the phrasing "above".
    – Yunnosch
    Oct 29, 2022 at 6:12
  • 1
    The other solutions' commands didn't resolve the issue, and pip3 --version was also broken with stacktrace output in the same way. I see the "offending" crypto.py at ~/.local/lib/python3.8/site-packages/localstack/utils/crypto.py but didn't think that commenting out a line was a proper solution. This solution seems like the actual fix. Nov 8, 2022 at 15:00
  • Interesting trick, however easy_install was not installed on my system :-( Nov 15, 2022 at 9:32
5

I stumbled into this problem this morning trying to install weasyprint after a system update and restart. Commenting out the line containing

X509_V_FLAG_CB_ISSUER_CHECK

in /usr/lib/python3/dist-packages/OpenSSL/crypto.py resulted in a further error

AttributeError: module 'lib' has no attribute 'OpenSSL_add_all_algorithms'

None of the suggested fixes would work for me.

  • sudo apt remove python3-pip followed by sudo apt install python3-pip
  • sudo pip install pyopenssl --upgrade
  • sudo python3 -m easy_install pyOpenSSL-22.0.0-py2.py3-none-any.whl
  • sudo pip install --force-reinstall "cryptography==38.0.4"

I found this module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK' but it didn't add to anything I already knew. I found this AttributeError: module 'lib' has no attribute 'OpenSSL_add_all_algorithms' but it comes with WARNINGS for people running on desktops and it causing significant system wide issues.

I tried upgrading OpenSSL via easy_install but the wheel could not be found and there was a depreciation warning. Eventually I came back to the comment by @Alexandr who said just remove OpenSSL with rm.

sudo rm -rf /usr/lib/python3/dist-packages/OpenSSL

From here I attempted to reinstall OpenSSL but found it was already statisfied. Maybe an older package was blocking and this was the root of the problem?

sudo pip install pyopenssl
Requirement already satisfied: pyopenssl in /usr/lib/python3/dist-packages (19.0.0)

I then upgraded pip and was able to install WeasyPrint which I hope confirms I have solved this issue.

pip install pip --upgrade
Successfully installed pip-22.3.1

pip install weasyprint
Successfully installed Pyphen-0.13.2 ... weasyprint-57.2 zopfli-0.2.2
3

Below commands worked for me...

sudo pip3 install pyopenssl

sudo pip3 install pyopenssl --upgrade

1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Jan 9 at 13:20
3

if you got this error when using pip, try this

rm -rf <python_path>/site-packages/OpenSSL

the problem will be solved.

2

I've tried upgrading pip and installing another version of pyOpenSSL from whl file, but that didn't work. The only thing that helped is removing the entire folder with OpenSSL module like that rm -rf ...python-3.8.10/lib/python3.8/site-packages/OpenSSL and then doing all the thing you need.

2
  • This is what worked for me. I tried all the other answers. Jul 11 at 14:40
  • 1
    Out of curiosity, does anyone know why this works?
    – cheriejw
    Sep 20 at 0:29
1

If you have pip completely broken, as @sgdesmet propose in a comment, the only option to resolve this issue is

"Edit the crypto.py file and remove the offending line by commenting it out with a #"

No other solutions work with me.

1
  • Unfortunately, there are more lines that are broken. Removing the entire package seems to be the best way out. Snake wrangling -- it's a way of life!
    – Jon Watte
    Sep 15 at 21:17
1

If you don't have sudo rights the --user option might do the trick:

wget https://bootstrap.pypa.io/get-pip.py && python3 get-pip.py --user
python3 -m pip install pyopenssl --upgrade --user
1

I got the same issue using Certbot, the right version was not the latest, so : pip3 install pyOpenSSL==23.1.1

0

If pip / pip3 is completely broken and nothing of the other option work (as described by @DarkSkull), then the line in the crypto.py file that's causing the issue has to be deleted or commented out.

Here's an automated way of doing it:

python_openssl_crypto_file="/usr/lib/python3/dist-packages/OpenSSL/crypto.py"
search_term="CB_ISSUER_CHECK = _lib.X509_V_FLAG_CB_ISSUER_CHECK"
cb_issuer_check_line_number="$(awk "/$search_term/ {print FNR}" $python_openssl_crypto_file)"
sed -i "${cb_issuer_check_line_number}s/.*/    # $search_term/" $python_openssl_crypto_file
2
  • Unfortunately, there will be more errors when this one's deleted. You need to remove and/or replace the entire package, because it's a python/ssl version mismatch problem.
    – Jon Watte
    Sep 15 at 21:18
  • For me, this code worked. But judging by the number of answers in this thread, there is no one right way to solve this problem. Just take these answers as inspiration and try until you get it to work for you. Eventually you can post another answer here. 😉
    – miu
    Sep 16 at 2:36
0

Thanks to the answers above I was able to solve the same problem. I use pipenv to manage my environment. The issue arose after upgrading my cryptography module.

The fix (for me):

pipenv update pyOpenSSL
1
  • hell yeah dude, thats awesome
    – Doug Coats
    Dec 16, 2022 at 4:40
0

For me, issue resolved by changing snowflake-connector-python package version from 2.7.1 to latest version in requirements.txt file of Azure function app.

0

issue on case was unneeded OpenSSL installed made the conflict and broke/block pip, problem solved when manual deleted OpenSSL folder within site-packages folder

eg deleted this folder in venv: venv/bin/python3.8/site-packages/OpenSSL

and fix pip issue global: usr/lib/python3.8/site-packages/OpenSSL

note found that due this error pip was broken and could not install or remove, after this solution I could install new packages and import packages that may install new one

0

Thank you for the suggestions. Once I realized the issue was the OpenSSL implementation, I just upgraded it using apt as follows:

apt-get install python3-openssl

This will resolve the issue system-wide as my Python enviro is maintained by the distro.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.