Certificate verify failed: unable to get local issuer certificate (_ssl.c:1108)

The problem here is as of our 1.1.0 release in January, Certbot no longer supports RHEL 6 based systems running architectures other than x86_64. There are many reasons for this, but it basically comes down to the Python and OpenSSL packages offered on non-86_64 RHEL 6 have reached their end of life upstream and are no longer receiving updates. Because of this, many of Certbot's Python dependencies have also dropped support for this software which means that scripts like certbot-auto cannot continue to update them so you get things like security fixes (unless we tried to safely provide our own versions of Python and OpenSSL outside of those provided by your OS which is just not feasible for the small Certbot team to do).

When you run certbot-auto on the system without a custom version of Python in your PATH, certbot-auto's full output should look something like:

Skipping bootstrap because certbot-auto is deprecated on this system.
WARNING: couldn't find Python 3.5+ to check for updates.
Your system is not supported by certbot-auto anymore.
Certbot cannot be installed.
Please visit https://certbot.eff.org/ to check for other alternatives.

And at https://certbot.eff.org/lets-encrypt/centos6-other, we say that non-x86_64 RHEL 6 is no longer supported by the Certbot team.

CentOS 6 reaches its end of life in November meaning that all of the packages on your system will no longer receive security updates. If updating your OS isn't feasible right now, your most reliable option is to use an old version of certbot-auto and include --no-self-upgrade on the command line. The last working version of certbot-auto on i686 CentOS 6 can be found at https://raw.githubusercontent.com/certbot/certbot/v1.0.0/certbot-auto. Including this flag means that you will not get any updates fixing bugs including security problems or compatibility issues with Let's Encrypt's servers.

Alternatively, you can continue to try to use a custom version of Python, but unfortunately the Certbot team does not have the resources to help you do this custom setup.

I'm sure all of this isn't what you want to hear, but I hope it helps!

2 Likes