For people encountering ssl.SSLError: [ASN1] nested asn1 error (_ssl.c:4145)

[levicki]

Cause:
Python bug with loading improperly encoded CA certificates from Windows root store:
https://bugs.python.org/issue35665

Resolution:
Change your Miniconda3/envs/ldm/lib/ssl.py code as follows:

    def _load_windows_store_certs(self, storename, purpose):
        certs = bytearray()
        try:
            for cert, encoding, trust in enum_certificates(storename):
                # CA certs are never PKCS#7 encoded
                if encoding == "x509_asn":
                    if trust is True or purpose.oid in trust:
                        try:
                            self.load_verify_locations(cadata=cert)
                            certs.extend(cert)
                        except SSLError:
                            warnings.warn("Bad certificate in Windows certificate store")
        except PermissionError:
            warnings.warn("unable to enumerate Windows certificate store")
        return certs

Explanation:
Code change will make Python verify Windows root store CA certificates one by one and only throw a warning on invalid ones instead of crashing.

[nmirkov]

This helped to resolve my issue, I also added logging to locate the bad certificate (of course it was a government issued one :) ).
Thanks a lot!

[IgorCode]

I assume the issue is from one of the MUP Srbija certificates?

[MarkoStanojevic12]

Jbt ja ne mogu da verujem na sta sam izgubio vreme...

[horosavin]

Momci, izgleda da me neki od ovih sertifikata sprecava da instaliram Tydiffusion u 3DS Max. Instalacija koristi "embedded" pitona i uopste ne znam u koji bi ssl (ima ih nekoliko u instalacionom folderu) trebalo da modifikujem i kako - posto nisam programer.
Da li imate neko resenje?

[IgorCode]

I "_load_windows_store_certs" se nalazi u svim tim ssl fajlovima?

[horosavin]

Zapravo, ne nalazi se ni u jednom...

[horosavin]

Karambol je napravio 24x07.co.yu Digitrust CA. Asseco. Sta reci...

[Vihershunde]

Thank you so much, it fixed the bug.
The issue is the Serbian government's certificates.

[yiqiangjun]

这是来自QQ邮箱的假期自动回复邮件。   您好，我最近正在休假中，无法亲自回复您的邮件。我将在假期结束后，尽快给您回复。

[whiteleon13]

Anyone who is having problems to even find ssl.py: get your python executable location, in that Python folder there is ssl.py and the function listed up

[yiqiangjun]

这是来自QQ邮箱的假期自动回复邮件。   您好，我最近正在休假中，无法亲自回复您的邮件。我将在假期结束后，尽快给您回复。