Repository navigation
Exporter: SSL Error #206
Description
How are you running it?
The window, from a downloaded release
Version, or commit
1.5.0
Operating system
Linux
Which route?
Signing in to iCloud
What happened
I tried signing in after the bug fix and everything works until you enter the right code via SMS or IDevice.
ClientConnectorCertificateError: Cannot connect to host setup.icloud.com:443 ssl:True [SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1032)')]
The log
└─Deluxo ► cat /tmp/OpenTagViewer/exporter.log
2026-09-14 18:34:12,519 INFO exporter.version: OpenTagViewer exporter 1.5.0
2026-09-14 18:34:12,519 WARNING exporter.privacy: ========================================================================================
2026-09-14 18:34:12,519 WARNING exporter.privacy: This log is for debugging and is NOT safe to publish as-is.
2026-09-14 18:34:12,519 WARNING exporter.privacy:
2026-09-14 18:34:12,520 WARNING exporter.privacy: It names your devices by name, model and serial, records keychain item attributes
2026-09-14 18:34:12,520 WARNING exporter.privacy: as Apple stores them, and identifies every device in your account's trust circle.
2026-09-14 18:34:12,520 WARNING exporter.privacy: No key, password or passcode is written here, and payloads appear only as byte
2026-09-14 18:34:12,520 WARNING exporter.privacy: counts - but nothing can promise a given identifier never appears, because the text
2026-09-14 18:34:12,520 WARNING exporter.privacy: comes from a library reading Apple's own structures.
2026-09-14 18:34:12,520 WARNING exporter.privacy:
2026-09-14 18:34:12,520 WARNING exporter.privacy: READ THIS FILE AND REMOVE ANYTHING THAT IDENTIFIES YOU BEFORE SENDING IT ANYWHERE.
2026-09-14 18:34:12,520 WARNING exporter.privacy: ========================================================================================
2026-09-14 18:34:12,520 INFO __main__: Starting OpenTagViewer AirTag Exporter 1.5.0
2026-09-14 18:34:38,651 INFO findmy.reports.account: Attempting authentication for user eggs@jamal.com
2026-09-14 18:34:38,669 INFO findmy.reports.anisette: The Anisette engine will download libraries required for operation, this may take a few seconds...
2026-09-14 18:34:38,669 INFO findmy.reports.anisette: To speed up future local Anisette initializations, provide a filesystem path to load the libraries from.
2026-09-14 18:34:39,775 INFO anisette.anisette: Provisioning...
2026-09-14 18:34:42,715 INFO findmy.reports.account: Detected 2FA requirement: trustedDeviceSecondaryAuth
2026-09-14 18:34:42,715 INFO findmy.reports.account: Transitioning login state: LoginState.LOGGED_OUT -> LoginState.REQUIRE_2FA
2026-09-14 18:34:56,451 INFO findmy.reports.account: Attempting authentication for user eggs@jamal.com
2026-09-14 18:34:57,038 INFO findmy.reports.account: GSA authentication successful
2026-09-14 18:34:57,038 INFO findmy.reports.account: Transitioning login state: LoginState.REQUIRE_2FA -> LoginState.AUTHENTICATED
2026-09-14 18:34:57,038 INFO findmy.reports.account: Logging into com.apple.mobileme
2026-09-14 18:34:57,236 ERROR __main__: Reading accessories failed
Traceback (most recent call last):
File "wizard.py", line 350, in _load
File "exporter/asyncui.py", line 180, in run_with_progress
File "exporter/asyncui.py", line 138, in _work
File "asyncio/runners.py", line 196, in run
File "asyncio/runners.py", line 119, in run
File "asyncio/base_events.py", line 726, in run_until_complete
File "wizard.py", line 484, in _read_icloud
File "exporter/icloud.py", line 448, in log_in
File "exporter/icloud.py", line 533, in _submit_code_with_retries
File "findmy/reports/twofactor.py", line 223, in submit
File "findmy/reports/account.py", line 1004, in td_2fa_submit
File "findmy/reports/account.py", line 1529, in _login_mobileme
File "findmy/util/http.py", line 230, in post
File "findmy/util/http.py", line 212, in request
File "findmy/util/http.py", line 190, in request
File "aiohttp/client.py", line 858, in _request
File "aiohttp/client.py", line 812, in _connect_and_send_request
File "aiohttp/connector.py", line 657, in connect
File "aiohttp/connector.py", line 1242, in _create_connection
File "aiohttp/connector.py", line 1620, in _create_direct_connection
File "aiohttp/connector.py", line 1589, in _create_direct_connection
File "aiohttp/connector.py", line 1318, in _wrap_create_connection
aiohttp.client_exceptions.ClientConnectorCertificateError: Cannot connect to host setup.icloud.com:443 ssl:True [SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1032)')]
2026-09-14 18:35:26,516 INFO findmy.reports.account: Attempting authentication for user eggs@jamal.com
2026-09-14 18:35:26,533 INFO findmy.reports.anisette: The Anisette engine will download libraries required for operation, this may take a few seconds...
2026-09-14 18:35:26,533 INFO findmy.reports.anisette: To speed up future local Anisette initializations, provide a filesystem path to load the libraries from.
2026-09-14 18:35:27,529 INFO anisette.anisette: Provisioning...
2026-09-14 18:35:30,033 INFO findmy.reports.account: Detected 2FA requirement: trustedDeviceSecondaryAuth
2026-09-14 18:35:30,033 INFO findmy.reports.account: Transitioning login state: LoginState.LOGGED_OUT -> LoginState.REQUIRE_2FA
2026-09-14 18:37:11,429 INFO findmy.reports.account: Attempting authentication for user eggs@jamal.com
2026-09-14 18:37:12,036 INFO findmy.reports.account: GSA authentication successful
2026-09-14 18:37:12,036 INFO findmy.reports.account: Transitioning login state: LoginState.REQUIRE_2FA -> LoginState.AUTHENTICATED
2026-09-14 18:37:12,036 INFO findmy.reports.account: Logging into com.apple.mobileme
2026-09-14 18:37:12,212 ERROR __main__: Reading accessories failed
Traceback (most recent call last):
File "wizard.py", line 350, in _load
File "exporter/asyncui.py", line 180, in run_with_progress
File "exporter/asyncui.py", line 138, in _work
File "asyncio/runners.py", line 196, in run
File "asyncio/runners.py", line 119, in run
File "asyncio/base_events.py", line 726, in run_until_complete
File "wizard.py", line 484, in _read_icloud
File "exporter/icloud.py", line 448, in log_in
File "exporter/icloud.py", line 533, in _submit_code_with_retries
File "findmy/reports/twofactor.py", line 173, in submit
File "findmy/reports/account.py", line 966, in sms_2fa_submit
File "findmy/reports/account.py", line 1529, in _login_mobileme
File "findmy/util/http.py", line 230, in post
File "findmy/util/http.py", line 212, in request
File "findmy/util/http.py", line 190, in request
File "aiohttp/client.py", line 858, in _request
File "aiohttp/client.py", line 812, in _connect_and_send_request
File "aiohttp/connector.py", line 657, in connect
File "aiohttp/connector.py", line 1242, in _create_connection
File "aiohttp/connector.py", line 1620, in _create_direct_connection
File "aiohttp/connector.py", line 1589, in _create_direct_connection
File "aiohttp/connector.py", line 1318, in _wrap_create_connection
aiohttp.client_exceptions.ClientConnectorCertificateError: Cannot connect to host setup.icloud.com:443 ssl:True [SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1032)')]Before you post
- I have read the log and taken out anything personal I did not want public.
Activity
MrBwoken commentedon Sep 14, 2026
Ran with dolphin file manager, i3 window manager, picom enabled, no vpn, with vpn same results, never had this issue with like altstore or any sideloading program so idk
MrBwoken commentedon Sep 14, 2026
found fix:
export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
MrBwoken commentedon Sep 14, 2026
ohh app is still broken 😭
parawanderer commentedon Sep 14, 2026
@MrBwoken do you get a new error once you set that SSL environment variable, or still the same one?
MrBwoken commentedon Sep 14, 2026
Once it's set it's fixed and no errors. Also when will app be fixed? GSA error still in app.
parawanderer commentedon Sep 14, 2026
@MrBwoken So I am trying to verify that the app works right now on 1.1.0 and got locked out of my apple account on the 2FA stage with 429 "Too Many Requests", which I am trying to wait out right now for 24hrs and then retrying.
If somebody else could verify whether the debug build works properly I could speed up releasing that.
If you (or anybody else) is up for it, you can pull the debug build from https://github.com/parawanderer/OpenTagViewer/actions/runs/34777896516 and test it out early.
It would be especially helpful if you could verify if you see any issues at any point and if the export/import history button and the new map provider works. The app was subject to the same Anisette header 503 issue so that question is also still open with it.
Note that it gets installed as a new app with its own (inverted) icon, it can be uninstalled separately and history between this debug version of the app does not carry over automatically (only a release build would inherit old history).
(I think your certificate issue here is a separate issue that I'll try to debug on my Linux box when I have the time)
MrBwoken commentedon Sep 14, 2026
OpenTagViewer app 1.1.0-debug (029a872) | tags imported from: nothing - no bundle imported
This device's log follows, unfiltered by the app: 1 lines, which is everything the device still had (asked for 5000).
--------- beginning of (HKS)4E95011D17F0F5A2AFC551C5ADDD6660850727228B34601D845055FBB2AAA9FA5B11C23A85E81DB6A45B6E3CB982B22C00E1BA3267755E7FD22C26BCCE6749E51A00E06AFDA521609E1D0474B3CE121D7C63453013E2639D4480A0A4E7C65F59C15A0EEE708726453B68036FBE39A6610AC1025F432474AEDE12BD53BB10A281C5B10ACAF7D40C1EDA6F37B592FB70CADD17F87051EFAECCB6754AE6EC4BADDB9905B8490B1FC65245A16AF27769C86A09C8FEDBBC7F2871857E2D9C6191E02626EE54D2BBFE13A662D1B5EAE7437E2CFB8897D62FB3FEA2974B2194D12A311D96AC5E55871387C75D2AD6C32876CA43667E54287BE587C7EF2301A22D8AB687(HKE)
OpenTagViewer app 1.1.0-debug (029a872) | tags imported from: nothing - no bundle imported
App errors, definitly not ratelimit. I think
MrBwoken commentedon Sep 14, 2026
by spam clicking login i can get it to work consistently. but when entering code it dosent work. (SMS)
MrBwoken commentedon Sep 14, 2026
When logging in with code (idevice not sms)
parawanderer commentedon Sep 14, 2026
Interesting, thanks for checking this! That looks like the same issue I got. Then there's now a deeper bug on the app side that causes this 429, which doesn't exist on the desktop exporter or CLI.
I think this will require sitting down with the app and debugging the logic of the login flow in it. Maybe it sends too many requests or something.
But yeah, that's a whole project/task at this point then. Might take a while to see what it's doing wrong. It otherwise is meant to be using the same login flow as the standalone exporters.
If anybody is up for it and wants to properly sit down in Android Studio and debug the login flow in the app, but I figure that's a pretty hard and annoying ask. I will try to fix it this week so that this 1.1.0 can be released myself otherwise.
MrBwoken commentedon Sep 14, 2026
got in with autoclicker importing with account dosent work I'll try zip and autoclicker
MrBwoken commentedon Sep 14, 2026
works after app crashed
parawanderer commentedon Sep 14, 2026
Two separate problems in this thread:
The Linux SSL error is fixed in #209. The frozen build had no CA bundle, so sign-in worked (Apple's root is pinned) but
setup.icloud.comright after the code did not. It now usescertifiautomatically, soSSL_CERT_FILEis no longer needed.The app 429 is a different thing and is not the app flooding Apple. The login button already ignores taps while one attempt is in flight, and the auth requests go through the same code as the working CLI. Spam-clicking helps because each attempt is one request and Apple is throttling them intermittently, so eventually one gets through. The most likely difference from the CLI is the Anisette identity the app uses locally, but there is currently no way to switch that from the login screen while local Anisette is working, so testing it needs an app change. Still being looked into.
parawanderer commentedon Sep 14, 2026
Hi, @MrBwoken
So this build: https://github.com/parawanderer/OpenTagViewer/actions/runs/34891034007 should have the same UI with a remote anisette server fallback on the "<-" page when the login fails on 429. Not a full fix yet for the native Anisette problem but that should enable the full app functionality again beyond a hands-off Anisette server. Still looking into why the native Anisette is a problem for now.
MrBwoken commentedon Sep 14, 2026
Thank you, i will try it out :D
parawanderer commentedon Sep 15, 2026
@MrBwoken the 429 has most likely been found and fixed — by @LiamJ74, who diagnosed it in the FindMy.py fork this app uses.
Apple's sign-in edge refuses the second request on a connection it has already answered. Signing in makes two, back to back, over one connection — so the second always got a
429while the first succeeded. That is why spam-clicking sometimes got you in: a retry occasionally landed on a fresh connection. It also explains why nothing about the account, the network or the Anisette server made any difference.A debug build with the fix is here, if you want to try it: https://github.com/parawanderer/OpenTagViewer/actions/runs/35021773249 — the APK is under Artifacts at the bottom of that page (you need to be signed in to GitHub to download it, and it comes as a zip).
Uninstall the previous debug build first — CI signs each one with a new key, which is what causes "App not installed".
If it still fails, the Export logs button on the sign-in screen now records what was sent and what Apple answered, which is the useful thing to attach.
parawanderer commentedon Sep 16, 2026
Fixed in exporter 1.5.1, which is out now.
Two separate faults were behind this thread, and both are fixed:
SSL_CERT_FILEby hand is no longer needed.429 Too Many Requests. Apple began refusing the second of the two requests a sign-in makes whenever both went down one connection. Each now gets a fresh one. Found and diagnosed by @LiamJ74.A third fix landed in the same release and is worth knowing about if you were on a slow link: the step that unlocks the keychain was only ever given five seconds to answer, and arrived as a bare
TimeoutError. It now waits as long as the rest of the program.Reopen if it recurs, or open a new issue with a log if you meet something different.
Give the frozen exporter a CA bundle when the system offers none
Offer a remote Anisette server when Apple refuses the sign-in