Home / server / Questions / 830284
In Process
cs378
Asked: 2017-02-03 14:51:46 +0800 CST

certbot for letsencrypt missing pyopenssl module

  • 772

I need help setting up the CertBot for LetsEncrypt

I am running on CentOS 7 with Python 2.7

When I run certbot I get the following error:

[root@li86-193 frappe-bench]#certbot certonly --manual

Traceback (most recent call last):
  File "/usr/bin/certbot", line 7, in <module>
    from certbot.main import main
  File "/usr/lib/python2.7/site-packages/certbot/main.py", line 21, in <module>
    from certbot import client
  File "/usr/lib/python2.7/site-packages/certbot/client.py", line 10, in <module>
    from acme import client as acme_client
  File "/usr/lib/python2.7/site-packages/acme/client.py", line 31, in <module>
    requests.packages.urllib3.contrib.pyopenssl.inject_into_urllib3()
  File "/usr/lib/python2.7/site-packages/requests/packages/urllib3/contrib/pyopenssl.py", line 112, in inject_into_urllib3
    _validate_dependencies_met()
  File "/usr/lib/python2.7/site-packages/requests/packages/urllib3/contrib/pyopenssl.py", line 147, in _validate_dependencies_met
    raise ImportError("'pyOpenSSL' module missing required functionality. "
ImportError: 'pyOpenSSL' module missing required functionality. Try upgrading to v0.14 or newer.

[root@li86-193 frappe-bench]# pip show certbot
Name: certbot
Version: 0.11.1
Summary: ACME client
Home-page: https://github.com/letsencrypt/letsencrypt
Author: Certbot Project
Author-email: [email protected]
License: Apache License 2.0
Location: /usr/lib/python2.7/site-packages
Requires: ConfigArgParse, configobj, zope.component, pytz, setuptools, cryptography, zope.interface, pyrfc3339, mock, parsedatetime, six, acme, PyOpenSSL

[root@li86-193 frappe-bench]# pip show pyopenssl
Name: pyOpenSSL
Version: 16.2.0
Summary: Python wrapper module around the OpenSSL library
Home-page: https://pyopenssl.readthedocs.io/
Author: Hynek Schlawack
Author-email: [email protected]
License: Apache License, Version 2.0
Location: /usr/lib/python2.7/site-packages
Requires: six, cryptography

Please help out

Thank you

centos7 certbot

10 Answers

  1. Don't try to install certbot manually on CentOS/RHEL systems. It just makes a huge mess. Instead, install it from EPEL.

    yum install epel-release
yum install certbot
    • 7

  2. I experienced this same issue twice on 2 separate Centos7 systems in the last 2 months. This is what worked for me:

    • yum remove pyOpenSSL [This will remove certbot installed via epel]
    • yum install openssl-devel python-devel [May or may not actually be necessary]
    • pip install certbot
    • pip install certbot-apache

    After completing these steps I was able to successfully renew my certificates with certbot.

    • 4

  3. I'm running into the same issue. Using python venv I was able to get certbot working using pip.

    Steps: Install virtualenv

    pip install virtualenv --upgrade

    Create a virtualenv

    virtualenv -p /usr/bin/python2.7 certbot

    Activate the certbot virtualenv

    . /root/certbot/bin/activate

    Your prompt might turn into something like this

    (certbot) [root@hostname ~]#

    Then pip install certbot

    pip install certbot

    Once complete you can test certbot command under the certbot virtualenv, but this is not practical if you are going to use cron to setup certbot renewals. So deactivate the virtual environment,

    (certbot) [root@hostname ~]# deactivate

    Now run the certbot command from

    /root/certbot/bin/certbot
    • 3

  4. The correct fix is:

    mv /usr/lib64/python2.7/site-packages/OpenSSL /usr/lib64/python2.7/site-packages/pyOpenSSL

    Thanks to cnritng frim github.

    • 3

  5. This seems to be working for me.

    Grab a rpm from here: http://rpm.pbone.net/index.php3/stat/4/idpl/31446026/dir/centos_7/com/pyOpenSSL-0.15.1-1.el7.noarch.rpm.html 

    wget ftp://ftp.muug.mb.ca/mirror/centos/7.2.1511/cloud/x86_64/openstack-mitaka/common/pyOpenSSL-0.15.1-1.el7.noarch.rpm
sudo rpm -Uvh pyOpenSSL-0.15.1-1.el7.noarch.rpm
sudo yum install certbot
    • 2

  6. Do not mix yum installed packages via pip ones. The proper fix involves removing pip packages and install everything from yum. I have outlined it here.

    You do not need newer pyOpenSSL on CentOS 7 to run certbot!

    pip uninstall requests
yum reinstall python-requests

pip uninstall six
yum reinstall python-six

pip uninstall urllib3
yum reinstall python-urllib3
    • 1

  7. I had the same problem in 0.9.3. It was caused by installing the nginx plugin.

    You can easily reproduce a working installation:

    docker run -it --rm centos:centos7 bash yum -y install epel-release yum -y install certbot certbot -h

    • 0

  8. just made it work by running

    sudo pip install pyOpenSSL==0.14.0

    it removed the 0.13 version and installed the 0.14, then certbot just worked normally.

    • 0

  9. It seems that the version of the epel source is too old, you can remove the certbot of the yum version and pip install it

    • 0

  10. Instead certbot, the letsencrypt client solved for me the problem.

    You can remove the other client(s)

    pip uninstall certbot
pip uninstall pyopenssl

    And then install letsencrypt:

    pip install letsencrypt
    • -4