2

When calling pip, e.g. pip3 install pillow --user

[SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC] decryption failed or bad record mac (_ssl.c:2548)

when calling git clone on any repository I get:

remote: Compressing objects: 100% (66/66), done.
error: RPC failed; curl 56 OpenSSL SSL_read: error:1408F119:SSL routines:ssl3_get_record:decryption failed or bad record mac, errno 0
error: 6237 bytes of body are still expected
fetch-pack: unexpected disconnect while reading sideband packet
fatal: early EOF
fatal: fetch-pack: invalid index-pack output

It's a Windows 10 system.

I attempted to download the newest OpenSSL and set all the system variables to point to its installation folder or config depending on the variable (OPENSSLDIR, PATH, OPENSSL_CONFIG, OPENSSL_CFG). The new version of OpenSSL was successfully detected (verified with openssl version -a), but the errors remained. I then tried downloading mozilla certificatates.pem as I was suggested by chatgpt, and added them with certutils, but that didn't help either.

I have tried different wifi networks - doesn't work even on university eduroam.

2 Answers 2

1

When you set up an encrypted connection with TLS (including with HTTPS), the connection includes a message authentication code (MAC) or a similar construction (an AEAD) to verify that the data has not been changed. This is important because it means that an attacker cannot tamper with your connection and this feature cannot be disabled.

The message “decryption failed or bad record mac” means that the MAC (or AEAD, as appropriate) validation failed, and the data received is not the data that was sent. The only safe thing to do is abort the connection, which was done. This isn't a certificate problem, but an indication that something, which could be software on your system, any network hardware between your computer and the destination, or anything in between, caused that data to be different.

On Windows, common reasons for failure are non-default antivirus or firewall software, as well as monitoring software. The recommended approach is to completely uninstall such software, and reboot (disabling it is often not enough), using only the default options (Windows Defender and Windows Firewall). It can also be a proxy or TLS MITM device on your network, poor quality Wi-Fi or network drivers (I've seen similar problems with some settings on Killer network cards), a flaky Internet connection, or really any sort of network problem, network software, or network device between your computer and the destination, inclusive. What that is, we can't know, but it's up to you to try to narrow it down and figure it out.

0

Sometimes, a VPN can cause this, try to disconnect it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.