R 语言关于 SSL 证书异常处理笔记
一、关于 TCGAbiolinks
TCGAbiolinks 是一个用于 TCGA 数据综合分析的 R/BioConductor 软件包,能够通过 GDC Application Programming Interface (API) 访问 National Cancer Institute (NCI) Genomic Data Commons (GDC) ,来搜索、下载和准备相关数据,以便在 R 中进行分析。
二、问题
神奇的是,今天在 R 操作 TCGAbiolinks 却遇到了一个极其棘手的问题:
library(TCGAbiolinks)
query <- GDCquery(project = "TARGET-OS",
data.category = "Transcriptome Profiling",
data.type = "Gene Expression Quantification",
workflow.type = "HTSeq - Counts")
![GDC server down, try to use this package later 1a526245-fe36-49d1-bcf7-f2ff55b61a31.png](https://oscimg.oschina.net/oscnet/1a526245-fe36-49d1-bcf7-f2ff55b61a31.png)
拿着这个 error 去谷歌,看到的结果都是教你用 devtools 或者 TCGAbiolink 官网提供的方法从 github 重装一遍这个包:
devtools::install_github("BioinformaticsFMRP/TCGAbiolinks")
BiocManager::install("BioinformaticsFMRP/TCGAbiolinks")
![google-gdc-error.png d6e45c54-e667-41a2-8c39-96bea14f1164.png](https://oscimg.oschina.net/oscnet/d6e45c54-e667-41a2-8c39-96bea14f1164.png)
三、源码分析
首先,我去 TCGAbiolink 中的源码看这个异常是在哪里导致的,在 R/internal.R 中发现:
![get-gdc-info.png 2d5fad05-a5a8-45d8-9eb0-c237233f58cf.png](https://oscimg.oschina.net/oscnet/2d5fad05-a5a8-45d8-9eb0-c237233f58cf.png)
> library(jsonlite)
> fromJSON("https://api.gdc.cancer.gov/status",simplifyDataFrame = TRUE)
Error in open.connection(con, "rb") :
SSL certificate problem: unable to get local issuer certificate
后来又看了一下 jsonlite
的 fromJSON
函数,发现它其实是基于 curl
包来实现获取,以及下载相关的数据。
The curl package provides bindings to the libcurl C library for R. The package supports retrieving data in-memory, downloading to disk, or streaming using the R “connection” interface. Some knowledge of curl is recommended to use this package. For a more user-friendly HTTP client, have a look at the httr package which builds on curl with HTTP specific tools and logic.
![curl-fail.png c0d99153-627f-4869-b487-68e55f450a21.png](https://oscimg.oschina.net/oscnet/c0d99153-627f-4869-b487-68e55f450a21.png)
$ curl -V
curl 7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.47.1 OpenSSL/1.0.1e zlib/1.2.8 libidn/1.18
Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: IDN IPv6 Largefile NTLM SSL libz
$ curl -h|grep ssl
--ftp-ssl Try SSL/TLS for ftp transfer (F)
--ftp-ssl-ccc Send CCC after authenticating (F)
--ftp-ssl-ccc-mode [active/passive] Set CCC mode (F)
--ftp-ssl-control Require SSL/TLS for ftp login, clear for transfer (F)
--ftp-ssl-reqd Require SSL/TLS for ftp transfer (F)
-2/--sslv2 Use SSLv2 (SSL)
-3/--sslv3 Use SSLv3 (SSL)
curl 的默认证书路径可以通过下面的命令查看:
$ curl -v https://www.baidu.com|& grep CAfile
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
$ curl-config --ca
/etc/pki/tls/certs/ca-bundle.crt
在前面jsonlite
的fromJSON
报错信息中有一个 More details here 的提示,里面给了证书下载地址:
http://curl.haxx.se/docs/sslcerts.html
![ca.png bea2e50d-7106-4454-bc13-4b33e89d2647.png](https://oscimg.oschina.net/oscnet/bea2e50d-7106-4454-bc13-4b33e89d2647.png)
$ wget https://curl.haxx.se/ca/cacert.pem --no-check-certificate
$ export CURL_CA_BUNDLE="/home/shenweiyan/certs/cacert.pem"
$ $ curl -v https://api.gdc.cancer.gov/status
* Trying 192.170.230.246...
* Connected to api.gdc.cancer.gov (192.170.230.246) port 443 (#0)
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: /home/shenweiyan/cacert.pem
CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* Server certificate:
* subject: CN=api.gdc.cancer.gov
* start date: Jan 29 00:00:00 2020 GMT
* expire date: Feb 16 23:59:59 2022 GMT
* subjectAltName: api.gdc.cancer.gov matched
* issuer: C=FR; ST=Paris; L=Paris; O=Gandi; CN=Gandi Standard SSL CA 2
* SSL certificate verify ok.
> GET /status HTTP/1.1
> Host: api.gdc.cancer.gov
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.47.1 OpenSSL/1.0.1e zlib/1.2.8 libidn/1.18
> Accept: */*
>
< HTTP/1.1 200 OK
< Date: Thu, 11 Jun 2020 09:17:33 GMT
< Server: Apache
< Content-Length: 144
< Access-Control-Allow-Origin: *
< Access-Control-Expose-Headers: Content-Disposition
< Content-Type: application/json
< X-Frame-Options: SAMEORIGIN
< Strict-Transport-Security: max-age=63072001; includeSubdomains; preload
<
{"commit":"ab22b47a0f2ba62dd69e83fc287fe0581e839cad","data_release":"Data Release 24.0 - May 07, 2020","status":"OK","tag":"2.1.2","version":1}
* Connection #0 to host api.gdc.cancer.gov left intact
四、解决问题与验证
虽然环境变量 CURL_CA_BUNDLE (也可以添加到 ~/.bashrc 中)可以解决 curl 命令行中的证书问题,但是在 R 中依然没办法解决 SL certificate problem: unable to get local issuer certificate 的问题。折腾了许久,找到两个方法。
本文分享自微信公众号 - 生信科技爱好者(bioitee)。
如有侵权,请联系 support@oschina.cn 删除。
本文参与“OSC源创计划”,欢迎正在阅读的你也加入,一起分享。