Getting "SSL connection error: unable to get local issuer certificate" Following Update to Python 3.7 Base Image

[orodri]

Hello. I use the Python 3.7 base image in a Django app which depends on mysqlclient and following the August 18th update I now encounter the following error: MySQLdb._exceptions.OperationalError: (2026, 'SSL connection error: unable to get local issuer certificate'). I rebuilt my app targeting the Python 3.7 base image from a week ago (sha256:63b5801a016dde01d0ed31d19ddbfed21a6f0b9748d6124175f672f0615dd4d3) and the error went away. Below is the stack trace incase it may be of help:

2021-08-19T14:05:25.433145073Z Traceback (most recent call last):
2021-08-19T14:05:25.433184374Z File "/usr/local/lib/python3.7/site-packages/django/db/backends/base/base.py", line 216, in ensure_connection
2021-08-19T14:05:25.433192174Z self.connect()
2021-08-19T14:05:25.433195974Z File "/usr/local/lib/python3.7/site-packages/django/db/backends/base/base.py", line 194, in connect
2021-08-19T14:05:25.433200174Z self.connection = self.get_new_connection(conn_params)
2021-08-19T14:05:25.433204274Z File "/usr/local/lib/python3.7/site-packages/django/db/backends/mysql/base.py", line 227, in get_new_connection
2021-08-19T14:05:25.433208374Z return Database.connect(**conn_params)
2021-08-19T14:05:25.433212174Z File "/usr/local/lib/python3.7/site-packages/MySQLdb/init.py", line 130, in Connect
2021-08-19T14:05:25.433216174Z return Connection(*args, **kwargs)
2021-08-19T14:05:25.433219774Z File "/usr/local/lib/python3.7/site-packages/MySQLdb/connections.py", line 185, in init
2021-08-19T14:05:25.433223674Z super().init(*args, **kwargs2)
2021-08-19T14:05:25.433227574Z MySQLdb._exceptions.OperationalError: (2026, 'SSL connection error: unable to get local issuer certificate')

My apologies if this issue is not with the base image but with one of my app's dependencies, but since my image works when built with an earlier Python 3.7 base image I thought I'd start by reporting here.

[wglambert]

That recent update was a fairly big change #633 the OS was bumped to the new Debian stable so the underlying packages used would also be updated and would incorporate any previous "breaking changes" that weren't implemented into the previous stable release

I imagine if you use the python:3.7-buster tag that'd work as expected

[yosifkit]

You can use the python:3.7-buster tag to pin to the Debian Buster images instead of moving to the Bullseye based images.

You may need to try a python-specific help forum to debug why your application doesn't work in Debian Bullseye but does in Buster. (If there is an bug with the image, we'd love to fix it)

[orodri]

Thank you both! Pinning to python:3.7-buster did indeed work for me. For reference this is a legacy app using Django 2.1.5 which is admittedly out of date. The image is probably fine so this issue can be closed.