False SSL validation failures for macOS

Development
1

I am experimenting with validating a https URL within Gramps. On Linux and Windows, the validation worked correctly and correctly recognized when internet connectivity was offline.

However, on macOS it claimed SSL failures.

This might affect the upcoming FamilySearch functionality for macOS… It appears that Gramps might need to do an extra step to support the macOS Keychain so that SSL reporting is correct. 

Testing URL: https://raw.githubusercontent.com/emyoulation/CuratedGrampsPlugins/master/gramps60/
Listings URL: https://raw.githubusercontent.com/emyoulation/CuratedGrampsPlugins/master/gramps60/listings/

Checking for: addons-da.json
⚠️  Network Error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1028)

Checking fallback: addons-en.json
❌ Network Error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1028)

Possible causes:
  • No internet connection
  • URL is incorrect
  • Server is down
  • Firewall blocking access

Claude reports:

Root Cause

On macOS, Python.org installers ship with an empty system CA store — Python does not use the macOS Keychain by default. Users must manually run /Applications/Python 3.x/Install Certificates.command to populate it. Until that happens, ssl.create_default_context() (with no arguments) has no CA bundle to validate against, so every HTTPS connection fails with CERTIFICATE_VERIFY_FAILED — even though the URL is perfectly valid and Gramps’ download path (which uses a different urllib call) may work fine.

Fix false SSL validation errors on macOS in Addon Manager.

On macOS with unconfigured Python certificates, the Test Location validator raised CERTIFICATE_VERIFY_FAILED even for valid repos. Added _make_ssl_context() to try certifi before the system default, improved the SSL error message with remediation steps, and treat SSL errors as a soft-pass so users can still save valid repositories.

Co-authored-by: Claude AI (Anthropic, claude-sonnet-4-6, 2026-07-22) Generated-by: prompted to fix macOS SSL false-positive in _fetch_json / _validate_web_url; see class docstring for full prompt description.

2

A couple of notes on this problem.

The standard solution to the problem on macOS is to run the “Install Certificates” command or run python -m pip install --upgrade certifi, but none of these options are available in the AIO Gramps for macOS.

I have manually copied the python keyring into the Gramps python in order to get the Gramps Web Sync add-on to automatically use latest user/pw pair. Although python keyring uses macOS Keychain, this doesn’t solve the problem seen in the experimental Addon Manager.

3

Another revision of the code suggest ways to resolve the SSL error. But that is above the paygrade of a module. Missing core installs should be handled during the Installer phase.
Plus the recommended fix is with a pip3 or CLI operation. As @csam objects above, that pip3 is not available by default on macOS.

⚠️  SSL Warning: Certificate verification failed
(URL structure appears valid — you may save and use this repository)

Testing URL: https://raw.githubusercontent.com/emyoulation/CuratedGrampsPlugins/master/gramps60
Listings folder: https://github.com/emyoulation/CuratedGrampsPlugins/tree/master/gramps60/listings
   (raw URL: https://raw.githubusercontent.com/emyoulation/CuratedGrampsPlugins/master/gramps60/listings/)

Checking for: addons-da.json
⚠️  SSL Certificate Error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1028)

The repository URL appears reachable but SSL certificate verification failed.  This is common on macOS when Python certificates have not been installed.

To fix, run once in a Terminal:
  /Applications/Python\ 3.x/Install\ Certificates.command

Or install the 'certifi' package:
  pip3 install certifi

The addon repository itself is likely valid — you may save it now and addons will download normally.

Checking fallback: addons-en.json
⚠️  SSL Certificate Error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1028)

The repository URL appears reachable but SSL certificate verification failed.  This is common on macOS when Python certificates have not been installed.

To fix, run once in a Terminal:
  /Applications/Python\ 3.x/Install\ Certificates.command

Or install the 'certifi' package:
  pip3 install certifi

The addon repository itself is likely valid — you may save it now and addons will download normally.

💾 Will be saved as: https://raw.githubusercontent.com/emyoulation/CuratedGrampsPlugins/master/gramps60
   (Gramps will append '/listings/addons-XX.json')