aws cli error - AttributeError: module 'lib' has no attribute 'X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT'

awscli 를 설치하고나서 aws --version 명령어를 통해 버전을 확인하려고 하니 다음과 같이 에러가 발생했다.

$ aws --version
Traceback (most recent call last):
  File "/opt/homebrew/bin/aws", line 19, in <module>
    import awscli.clidriver
  File "/opt/homebrew/Cellar/awscli/2.13.38/libexec/lib/python3.11/site-packages/awscli/clidriver.py", line 21, in <module>
    import botocore.session
  File "/opt/homebrew/Cellar/awscli/2.13.38/libexec/lib/python3.11/site-packages/awscli/botocore/session.py", line 27, in <module>
    import botocore.client
  File "/opt/homebrew/Cellar/awscli/2.13.38/libexec/lib/python3.11/site-packages/awscli/botocore/client.py", line 16, in <module>
    from botocore import UNSIGNED, waiter, xform_name
  File "/opt/homebrew/Cellar/awscli/2.13.38/libexec/lib/python3.11/site-packages/awscli/botocore/waiter.py", line 17, in <module>
    from botocore.docs.docstring import WaiterDocstring
  File "/opt/homebrew/Cellar/awscli/2.13.38/libexec/lib/python3.11/site-packages/awscli/botocore/docs/__init__.py", line 15, in <module>
    from botocore.docs.service import ServiceDocumenter
  File "/opt/homebrew/Cellar/awscli/2.13.38/libexec/lib/python3.11/site-packages/awscli/botocore/docs/service.py", line 14, in <module>
    from botocore.docs.client import ClientDocumenter, ClientExceptionsDocumenter
  File "/opt/homebrew/Cellar/awscli/2.13.38/libexec/lib/python3.11/site-packages/awscli/botocore/docs/client.py", line 16, in <module>
    from botocore.docs.example import ResponseExampleDocumenter
  File "/opt/homebrew/Cellar/awscli/2.13.38/libexec/lib/python3.11/site-packages/awscli/botocore/docs/example.py", line 13, in <module>
    from botocore.docs.shape import ShapeDocumenter
  File "/opt/homebrew/Cellar/awscli/2.13.38/libexec/lib/python3.11/site-packages/awscli/botocore/docs/shape.py", line 19, in <module>
    from botocore.utils import is_json_value_header
  File "/opt/homebrew/Cellar/awscli/2.13.38/libexec/lib/python3.11/site-packages/awscli/botocore/utils.py", line 33, in <module>
    import botocore.httpsession
  File "/opt/homebrew/Cellar/awscli/2.13.38/libexec/lib/python3.11/site-packages/awscli/botocore/httpsession.py", line 41, in <module>
    from urllib3.contrib.pyopenssl import orig_util_SSLContext as SSLContext
  File "/opt/homebrew/Cellar/awscli/2.13.38/libexec/lib/python3.11/site-packages/urllib3/contrib/pyopenssl.py", line 50, in <module>
    import OpenSSL.crypto
  File "/opt/homebrew/lib/python3.11/site-packages/OpenSSL/__init__.py", line 8, in <module>
    from OpenSSL import SSL, crypto
  File "/opt/homebrew/lib/python3.11/site-packages/OpenSSL/SSL.py", line 276, in <module>
    class X509VerificationCodes:
  File "/opt/homebrew/lib/python3.11/site-packages/OpenSSL/SSL.py", line 288, in X509VerificationCodes
    ERR_UNABLE_TO_GET_ISSUER_CERT = _lib.X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT
                                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: module 'lib' has no attribute 'X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT'

 

 

그래서 관련된 내용을 찾아보니 다음과 같이 github issue 를 보게 되었다.

https://github.com/aws/aws-cli/issues/7942

ERR_UNABLE_TO_GET_ISSUER_CERT error (and workaround detailed below) · Issue #7942 · aws/aws-cli

 

github issue 에 달린 comment 를 확인해보니 aws-cli 는 brew 를 통해 설치하는 것은 공식적으로 지원되지 않는다고 한다.
자세하게 읽어보지는 않았지만 github issue 에 설명되어있는 방법으로 설치하는 것이 좋다고 한다.
그전에 brew 를 통해 aws cli 를 설치하는 것을 지양해야할 것 같다.

 

이러한 에러가 발생하는 원인은 pyOpenSSL 이 사용하는 암호화 라이브러리와 관련이 있어 에러가 난다고 한다.

그래서 해결 방법으로는 다음과 같이 pyOpenSSL 을 설치해주면 된다.

python3 -m pip install pyOpenSSL==23.1.0

 

설치하고나서 다시 확인해보았다. 그리고 정상적으로 aws cli 가 실행되는 것을 확인할 수 있었다.

$ aws --version                           
aws-cli/2.13.38 Python/3.11.6 Darwin/22.6.0 source/arm64 prompt/off