Dataiku DSS start failed : Download failed: unable to get local issuer certificate

Rvk

Dataiku DSS start failed :

Download failed: unable to get local issuer certificate

Dataiku is not starting in the Macos 12.3.1 , the installation file is downloaded again from the Dataiku website tried reinstall multiple times

2022-06-21 11:01:40.749 +0400] INFO: Getting latest Dataiku DSS info from https://cdn.downloads.dataiku.com/public/launcher/dss-latest.json
[2022-06-21 11:01:41.087 +0400] ERROR: Error calling https://cdn.downloads.dataiku.com/public/launcher/dss-latest.json
[2022-06-21 11:01:41.087 +0400] ERROR (RequestError): unable to get local issuer certificate
RequestError: unable to get local issuer certificate
at ClientRequest.<anonymous> (/Applications/DataScienceStudio.app/Contents/Resources/app.asar/node_modules/got/dist/source/core/index.js:956:111)
at Object.onceWrapper (events.js:422:26)
at ClientRequest.emit (events.js:327:22)
at ClientRequest.origin.emit (/Applications/DataScienceStudio.app/Contents/Resources/app.asar/node_modules/@szmarczak/http-timer/dist/source/index.js:43:20)
at TLSSocket.socketErrorListener (_http_client.js:469:9)
at TLSSocket.emit (events.js:315:20)
at emitErrorNT (internal/streams/destroy.js:106:8)
at emitErrorCloseNT (internal/streams/destroy.js:74:3)
at processTicksAndRejections (internal/process/task_queues.js:80:21)
at TLSSocket.onConnectSecure (_tls_wrap.js:1497:34)
at TLSSocket.emit (events.js:315:20)
at TLSSocket._finishInit (_tls_wrap.js:932:8)
at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:706:12)
[2022-06-21 11:01:41.534 +0400] INFO: testing that dependencies are properly working
[2022-06-21 11:01:41.536 +0400] INFO: /Users/dsg281/Library/DataScienceStudio/Java/jdk8u322-b06/Contents/Home/bin/java does not exist.
[2022-06-21 11:01:41.536 +0400] INFO: /Users/dsg281/Library/DataScienceStudio/Python/python3.7-20220516/bin/python3.7 does not exist.

---

Operating system used: macos

Alexandru

Hi @Rvk
,

Are you using the macOS installer? Can you confirm if you have installed supported Java JDK?

https://doc.dataiku.com/dss/latest/installation/other/osx.html#macos-prerequisites

Please try installing java first and then run the installer again and share what error you are seeing.

Thanks,

AlexandreV

Hello @Rvk
,

This morning Cloudflare had a service issue (more details here ) that made https://cdn.downloads.dataiku.com/public/launcher/dss-latest.json un reachable for a short time (this was quickly resolved). It seems that unluckily you installed Dataiku DSS during this incident.

Could you try to relaunch the DataScienceStudio app? (no need to download it again)

Best,

Alex

Rvk

Getting same error

[2022-06-22 15:22:17.760 +0400] INFO: Update for version 1.3.4 is not available (latest version: 1.3.4, downgrade is disallowed).
[2022-06-22 15:22:18.149 +0400] INFO: Getting latest Dataiku DSS info from https://cdn.downloads.dataiku.com/public/launcher/dss-latest.json
[2022-06-22 15:22:18.275 +0400] ERROR: Error calling https://cdn.downloads.dataiku.com/public/launcher/dss-latest.json
[2022-06-22 15:22:18.275 +0400] ERROR (RequestError): unable to get local issuer certificate
RequestError: unable to get local issuer certificate
at ClientRequest.<anonymous> (/Applications/DataScienceStudio.app/Contents/Resources/app.asar/node_modules/got/dist/source/core/index.js:956:111)
at Object.onceWrapper (events.js:422:26)
at ClientRequest.emit (events.js:327:22)
at ClientRequest.origin.emit (/Applications/DataScienceStudio.app/Contents/Resources/app.asar/node_modules/@szmarczak/http-timer/dist/source/index.js:43:20)
at TLSSocket.socketErrorListener (_http_client.js:469:9)
at TLSSocket.emit (events.js:315:20)
at emitErrorNT (internal/streams/destroy.js:106:8)
at emitErrorCloseNT (internal/streams/destroy.js:74:3)
at processTicksAndRejections (internal/process/task_queues.js:80:21)
at TLSSocket.onConnectSecure (_tls_wrap.js:1497:34)
at TLSSocket.emit (events.js:315:20)
at TLSSocket._finishInit (_tls_wrap.js:932:8)
at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:706:12)
[2022-06-22 15:22:18.658 +0400] INFO: testing that dependencies are properly working

AlexandreV

Hi @Rvk
,

could you try running the following command in your terminal in order to test if you can reach the url?

curl -vvv https://cdn.downloads.dataiku.com/public/launcher/dss-latest.json

and answer with the output?

Best,
alex

Turribeach

Similar to this post:

https://community.dataiku.com/t5/Setup-Configuration/Data-Science-Studio-startup-failed-on-MacOS-12-3/m-p/24487

asamba

https://community.dataiku.com/discussion/comment/26797#Comment_26797

% curl -vvv https://cdn.downloads.dataiku.com/public/launcher/dss-latest.json
* Host cdn.downloads.dataiku.com:443 was resolved.
* IPv6: 2600:9000:26c8:3e00:5:d0bf:c400:93a1, 2600:9000:26c8:f800:5:d0bf:c400:93a1, 2600:9000:26c8:3c00:5:d0bf:c400:93a1, 2600:9000:26c8:cc00:5:d0bf:c400:93a1, 2600:9000:26c8:a00:5:d0bf:c400:93a1, 2600:9000:26c8:8a00:5:d0bf:c400:93a1, 2600:9000:26c8:f400:5:d0bf:c400:93a1, 2600:9000:26c8:ae00:5:d0bf:c400:93a1
* IPv4: 3.161.242.36, 3.161.242.128, 3.161.242.71, 3.161.242.113
*   Trying 3.161.242.36:443...
* Connected to cdn.downloads.dataiku.com (3.161.242.36) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-AES256-GCM-SHA384 / [blank] / UNDEF
* ALPN: server did not agree on a protocol. Uses default.
* Server certificate:
*  subject: CN=cdn.downloads.dataiku.com; O=Zscaler Inc.; OU=Zscaler Inc.
*  start date: Jun 23 15:20:40 2025 GMT
*  expire date: Jul  5 04:43:08 2025 GMT
*  subjectAltName: host "cdn.downloads.dataiku.com" matched cert's "cdn.downloads.dataiku.com"
*  issuer: C=US; ST=California; O=Zscaler Inc.; OU=Zscaler Inc.; CN=Zscaler Intermediate Root CA (zscaler.net) (t)
*  SSL certificate verify ok.
* using HTTP/1.x
> GET /public/launcher/dss-latest.json HTTP/1.1
> Host: cdn.downloads.dataiku.com
> User-Agent: curl/8.7.1
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 200 OK
< Content-Type: application/json
< Content-Length: 303
< Connection: keep-alive
< Server: Apache
< Strict-Transport-Security: max-age=31536000; includeSubDomains
< Last-Modified: Tue, 10 Jun 2025 12:06:32 GMT
< Accept-Ranges: bytes
< Date: Mon, 23 Jun 2025 16:20:40 GMT
< ETag: "12f-6373686fba33b"
< X-Cache: Hit from cloudfront
< Via: 1.1 73e1c8a8f725beb3c770cb76b55eddae.cloudfront.net (CloudFront)
< X-Amz-Cf-Pop: DFW57-P7
< X-Amz-Cf-Id: uq5pKFsY3HosiyrfE78wu5r8JaFRuOsyXVnCRnsmHd_3QC8fU7iU_w==
< Age: 11
<
{
    "mac": {
        "version": "13.5.5",
        "url": "https://cdn.downloads.dataiku.com/public/dss/13.5.5/dataiku-dss-13.5.5-osx.tar.gz"
    },
    "win": {
        "version": "13.5.5",
        "url": "https://cdn.downloads.dataiku.com/public/studio/13.5.5/dataiku-dss-13.5.5-win.tar.gz"
    }
}

* Connection #0 to host cdn.downloads.dataiku.com left intact

asamba

Posted the output above. thanks.

Turribeach

Your company uses Zscaler as an internet proxy and it's doing SSL interception and replacing the real SSL certificate issued to cdn.downloads.dataiku.com by Amazon (see screen shot below) with one issued by Zscaler Root Certificate Authority (see "C=US; ST=California; O=Zscaler Inc.; OU=Zscaler Inc.; CN=Zscaler Intermediate Root CA (zscaler.net)" on your curl log). So when the Dataiku installer tries to validate the cdn.downloads.dataiku.com certificate it can't because it doesn't trust the Zscaler Root CA. In theory this should be solvable. You should be able to add the Zscaler Intermediate Root CA so that it's trusted by the Java process that does the install, but I don't know the steps to do this. Perhaps @Alexandru can help?

asamba

ok, makes sense. I hope dataiku @Alexandru  can add the zscalar root ca to the download ; i am sure this wil be the case for most enterprise with zscalar. Hopefully it is added and i can run my install.. will wait.

Many thanks.

Turribeach

https://community.dataiku.com/discussion/comment/46193#Comment_46193

No, that's not how this is fixed. This is fixed by customising the Open Java JDK install in your machine to add this Root CA. Only you can do that.

asamba

ok, will try that, thanks much for your support and replies. very helpful and quick as well. appreciate it.