detect download failure due to outdated certificate and print helpful warning?

[boegel]

With the expiration of the Let's Encrypt root certificate, several people are running into download issues if their ca-certificates RPM, or equivalent, is not up-to-date; see for example easybuilders/easybuild-easyconfigs#14138:

 <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618)>

Maybe we can/should recognize the error message that pops up when a download fails due to certificate issues, and produce a helpful warning to a link in the EasyBuild docs in this case?

edit: see also https://it.slashdot.org/story/21/10/02/2318202/millions-experience-browser-problems-after-long-anticipated-expiration-of-lets-encrypt-certificate

[boegel]

One thing I do wonder if this could lead to (many?) false positive warnings, where some download indeed failed, but then succeeds just fine later.

So ideally we post-pone printing the warning until all source URLs have been tried, maybe?

[JorisRommelse]

Downloads can go wrong for millions of reasons. Why catch one and include it in a warning? It already goes to the log. I think it needs to be decided whether it should go to the screen as well, or not. But I would not send one reason to screen and one million minus one to log.

[boegel]

I'll close this, the certificate verification failure could indeed have any number of reasons, so it wouldn't really be possible to come up with a meaningful truly helpful error message.

If anything, this issue can serve as a hint to what could be wrong.