CERTIFICATE_VERIFY_FAILED - probably related to LetsEncrypt certificate expiration (Sep. 30th, 2021)

[arminfuerst]

Checklist

• I'm reporting a broken site support issue
• I've verified that I'm running youtube-dl version 2021.06.06
• I've checked that all provided URLs are alive and playable in a browser
• I've checked that all URLs and arguments with special characters are properly quoted or escaped
• I've searched the bugtracker for similar bug reports including closed ones
• I've read bugs section in FAQ

Verbose log

[debug] System config: []
[debug] User config: []
[debug] Custom config: []
[debug] Command-line args: ['--write-thumbnail', '--write-description', '-v', 'https://www.tele5.de/relic-hunter/ganze-folge/das-zepter/']
[debug] Encodings: locale UTF-8, fs utf-8, out utf-8, pref UTF-8
[debug] youtube-dl version 2021.06.06
[debug] Python version 3.9.2 (CPython) - Linux-5.10.0-9-amd64-x86_64-with-glibc2.31
[debug] exe versions: ffmpeg 4.4, ffprobe 4.4, rtmpdump 2.4
[debug] Proxy map: {}
[debug] Using fake IP 53.236.246.185 (DE) as X-Forwarded-For.
[Tele5] das-zepter: Downloading webpage
[debug] Using fake IP 53.131.126.240 (DE) as X-Forwarded-For.
[JWPlatform] Kca7WjNI: Downloading JSON metadata
[JWPlatform] Kca7WjNI: Downloading m3u8 information
WARNING: Failed to download m3u8 information: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1123)>
ERROR: No video formats found; please report this issue on https://yt-dl.org/bug . Make sure you are using the latest version; see  https://yt-dl.org/update  on how to update. Be sure to call youtube-dl with the --verbose flag and include its complete output.
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/youtube_dl/YoutubeDL.py", line 815, in wrapper
    return func(self, *args, **kwargs)
  File "/usr/lib/python3/dist-packages/youtube_dl/YoutubeDL.py", line 836, in __extract_info
    ie_result = ie.extract(url)
  File "/usr/lib/python3/dist-packages/youtube_dl/extractor/common.py", line 534, in extract
    ie_result = self._real_extract(url)
  File "/usr/lib/python3/dist-packages/youtube_dl/extractor/jwplatform.py", line 46, in _real_extract
    return self._parse_jwplayer_data(json_data, video_id)
  File "/usr/lib/python3/dist-packages/youtube_dl/extractor/common.py", line 2795, in _parse_jwplayer_data
    self._sort_formats(formats)
  File "/usr/lib/python3/dist-packages/youtube_dl/extractor/common.py", line 1374, in _sort_formats
    raise ExtractorError('No video formats found')
youtube_dl.utils.ExtractorError: No video formats found; please report this issue on https://yt-dl.org/bug . Make sure you are using the latest version; see  https://yt-dl.org/update  on how to update. Be sure to call youtube-dl with the --verbose flag and include its complete output.

Description

Downloading from Tele5 seems to be impossible because of a certificate error. When using the parameter --no-check-certificate, the download is working properly.
Tele5 is using a LetsEncrypt certificate and there was an expiration of the root certificate (https://letsencrypt.org/2021/10/01/cert-chaining-help.html). Other sites using LetsEncrypt might also be effected, I am using Tele5 for reproducing this bug.

[ghost]

Please check OpenSSL version used in your Python: python -c 'import ssl; print(ssl.OPENSSL_VERSION)'
If it's 1.0.2, read this guide: https://www.openssl.org/blog/blog/2021/09/13/LetsEncryptRootCertExpire/

[arminfuerst]

python -c 'import ssl; print(ssl.OPENSSL_VERSION)'

python -c 'import ssl; print(ssl.OPENSSL_VERSION)'
OpenSSL 1.1.1k 25 Mar 2021

[dirkf]

yt-dl depends on its Python and/or the underlying OS being configured properly. Typically, the Python/OpenSSL root certificates are configured with the certifi module (see why), which provides the root certificates from Mozilla:

>>> import certifi
>>> certifi.where()
'/etc/ssl/certs/ca-certificates.crt'
>>>

In which case that module needs to be updated, whether via pip or updating a distro package (eg, python3-certifi).

Otherwise your configuration may be taking the root certificates from the OS, in which case the OS needs to be updated (eg ca-certificates package).