Certificate verify failed

Install, Configure and Update
1

Cryosparc instance information:
Type = single workstation
Software version = 4.7.1
uname -a && free -g output =
Linux redacted 6.5.0-21-generic #21~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Fri Feb 9 13:32:52 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
total used free shared buff/cache available
Mem: 62 3 53 0 5 58
Swap: 1 0 1

Cryosparc worker environment:

Thu Nov 13 10:47:03 2025
±----------------------------------------------------------------------------------------+
| NVIDIA-SMI 550.54.14              Driver Version: 550.54.14      CUDA Version: 12.4     |
|-----------------------------------------±-----------------------±---------------------+
| GPU  Name                 Persistence-M | Bus-Id          Disp.A | Volatile Uncorr. ECC |
| Fan  Temp   Perf          Pwr:Usage/Cap |           Memory-Usage | GPU-Util  Compute M. |
|                                         |                        |               MIG M. |
|=========================================+========================+======================|
|   0  NVIDIA GeForce RTX 3050 OEM    Off |   00000000:01:00.0 Off |                  N/A |
|  0%   51C    P8             11W /  120W |      17MiB /   8192MiB |      0%      Default |
|                                         |                        |                  N/A |
±----------------------------------------±-----------------------±---------------------+

±----------------------------------------------------------------------------------------+
| Processes:                                                                              |
|  GPU   GI   CI        PID   Type   Process name                              GPU Memory |
|        ID   ID                                                               Usage      |
|=========================================================================================|
|    0   N/A  N/A      1678      G   /usr/lib/xorg/Xorg                              9MiB |
|    0   N/A  N/A      1882      G   /usr/bin/gnome-shell                            2MiB |
±----------------------------------------------------------------------------------------+

Issue:

I have recently installed cryosparc, but when I try to start the first job “import micrographs” it says:

[Verify Failed] certificate verify failed: self signed certificate in certificate chain.

When I tried to check the cryosparc status (cryosparcm status) the output is:

CryoSPARC System master node installed at

/home/cryoem/cryosparc/cryosparc_master
Current cryoSPARC version: v4.7.1

CryoSPARC process status:

app RUNNING pid 24742, uptime 1 day, 19:17:34
app_api RUNNING pid 24764, uptime 1 day, 19:17:32
app_api_dev STOPPED Not started
command_core RUNNING pid 24667, uptime 1 day, 19:17:43
command_rtp RUNNING pid 24728, uptime 1 day, 19:17:36
command_vis RUNNING pid 24696, uptime 1 day, 19:17:38
database RUNNING pid 24563, uptime 1 day, 19:17:47

WARNING: Could NOT verify active license “redacted”

License validation results:

✓ CRYOSPARC_LICENSE_ID environment variable is set
✓ License has correct format
✓ Insecure mode is disabled
✓ License server set to “https://get.cryosparc.com”
✕ Connection to license server FAILED

While verifying the license, CryoSPARC encountered HTTPSConnectionPool(host=‘get.cryosparc.com’, port=443): Max retries exceeded with url: /checklicenseexists/redacted (Caused by SSLError(SSLCertVerificationError(1, ‘[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1007)’)))

global config variables:
export CRYOSPARC_LICENSE_ID=“redacted”
export CRYOSPARC_MASTER_HOSTNAME=“redacted”
export CRYOSPARC_DB_PATH=“/home/cryoem/cryosparc/cryosparc_database”
export CRYOSPARC_BASE_PORT=39000
export CRYOSPARC_DB_CONNECTION_TIMEOUT_MS=20000
export CRYOSPARC_INSECURE=false
export CRYOSPARC_DB_ENABLE_AUTH=true
export CRYOSPARC_CLUSTER_JOB_MONITOR_INTERVAL=10
export CRYOSPARC_CLUSTER_JOB_MONITOR_MAX_RETRIES=1000000
export CRYOSPARC_PROJECT_DIR_PREFIX=‘CS-’
export CRYOSPARC_DEVELOP=false
export CRYOSPARC_CLICK_WRAP=true

when I try to access cryosparc by typing:
curl [license endpoint]
the output is:
{“message”:“Missing Authentication Token”}

Please could you give me some advice about what the problem could be?
Thank you!

2

Welcome to the forum @CLuk . Please can you post the outputs of these commands:

cryosparcm call env | grep -i -e proxy -e bundle
cryosparcm call which curl
cryosparcm call curl -v https://get.cryosparc.com

Could traffic be intercepted by a http proxy in your network?

5

Hello wtwmpel,

thank you for your help!
The outputs of the commands are:

bin/cryosparcm call env | grep -i -e proxy -e bundle
(this didn’t give an output)

bin/cryosparcm call which curl
/usr/bin/curl

bin/cryosparcm call curl -v https://get.cryosparc.com

* Trying 3.166.49.76:443…
* Connected to get. cryosparc. com (3.166.49.76) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
* ALPN, server accepted to use h2
* Server certificate:
* subject: CN=get.cryosparc. com
* start date: Jul 26 00:00:00 2025 GMT
* expire date: Aug 23 23:59:59 2026 GMT
* subjectAltName: host “get.cryosparc. com” matched cert’s “get.cryosparc. com”
* issuer: C=US; ST=California; L=Sunnyvale; O=Fortinet; OU=Certificate Authority; CN=FG3K4ETB20900071; emailAddress=support@fortinet. com
* SSL certificate verify ok.
* Using HTTP2, server supports multiplexing
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* Using Stream ID: 1 (easy handle 0x55c6a40eceb0)
* TLSv1.2 (OUT), TLS header, Supplemental data (23):

> GET / HTTP/2
> Host: get.cryosparc. com
> user-agent: curl/7.81.0
> accept: */*

* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
  < HTTP/2 403
  < content-type: application/json
  < content-length: 42
  < date: Fri, 14 Nov 2025 10:02:27 GMT
  < x-amz-apigw-id: UByoEGxrIAMEKsA=
  < x-amzn-requestid: 1d5f8d9b-97e6-4aa9-ae19-11bec1e2d9ff
  < x-amzn-errortype: MissingAuthenticationTokenException
  < x-cache: Error from cloudfront
  < via: 1.1 d05169e6032c60dfe1c0edd3c730b93e.cloudfront. net (CloudFront)
  < x-amz-cf-pop: LHR3-P1
  < x-amz-cf-id: IxEO0ycLCrqAII1O5TrpOMuGGiEQg635H3SpTzTZFzwEKFBfAHUMkA==
  <
* Connection #0 to host get.cryosparc. com left intact
6

@CLuk Were you able to resolve this issue? If not, would you like to check if the certificate check still fails after you

  1. add the line
    export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
    to the file
    /home/cryoem/cryosparc/cryosparc_master/config.sh
    (Certificate and config file paths are specific to your CryoSPARC installation and based on outputs you posted earlier.
  2. restart CryoSPARC

?

7

Hi wtempel,

thank you so much - adding the line to the config.sh file worked, and now it is running without any problems.

Thank you so much for your help!

1 Like