Repository navigation
SSL exception on a fresh installation #1697
Description
What happened?
The App crashes when trying to download a new package or a new model. This happens on a fresh fedora 44 installation, and freshly downloaded stability matrix appimage.
Exception Details
Exception
HttpRequestException: The SSL connection could not be established, see inner exception.
AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: PartialChain
Sentry ID
Stack Trace
at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.InjectNewHttp11ConnectionAsync(QueueItem queueItem)
at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at Microsoft.Extensions.Http.Logging.LoggingHttpMessageHandler.<SendCoreAsync>g__Core|4_0(HttpRequestMessage request, Boolean useAsync, CancellationToken cancellationToken)
at Microsoft.Extensions.Http.Logging.LoggingScopeHttpMessageHandler.<SendCoreAsync>g__Core|4_0(HttpRequestMessage request, Boolean useAsync, CancellationToken cancellationToken)
at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
at StabilityMatrix.Core.Services.DownloadService.DownloadToFileAsync(String downloadUrl, String downloadPath, IProgress`1 progress, String httpClientName, CancellationToken cancellationToken)
at StabilityMatrix.Core.Services.DownloadService.DownloadToFileAsync(String downloadUrl, String downloadPath, IProgress`1 progress, String httpClientName, CancellationToken cancellationToken)
at StabilityMatrix.Avalonia.Helpers.UnixPrerequisiteHelper.InstallPythonIfNecessary(PyVersion version, IProgress`1 progress)
at StabilityMatrix.Avalonia.Helpers.UnixPrerequisiteHelper.InstallPythonIfNecessary(IProgress`1 progress)
at StabilityMatrix.Avalonia.ViewModels.Settings.MainSettingsViewModel.CheckPythonVersion()
at CommunityToolkit.Mvvm.Input.AsyncRelayCommand.AwaitAndThrowIfFailed(Task executionTask)
at System.Threading.Tasks.Task.<>c.<ThrowAsync>b__128_0(Object state)
at Avalonia.Threading.SendOrPostCallbackDispatcherOperation.InvokeCore()```
``` at System.Net.Security.SslStream.CompleteHandshake(SslAuthenticationOptions sslAuthenticationOptions)
at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)```
### Version
v2.16.1
### What Operating System are you using?
Linux
Activity
NeuralFault commentedon Jul 28, 2026
Test with this to rule out OS-side from the issue (SM may rely on host cert store local on the distro):
curl -I https://github.comIn your terminal run these and then relaunch SM:
sudo dnf updateThen,
sudo dnf reinstall ca-certificatesThen,
sudo update-ca-trust extractkiprok commentedon Jul 28, 2026
Thank you for the response!
The curl command gave me normal output back.
I tried the other commands but still the issue remains sadly.
NeuralFault commentedon Jul 29, 2026
I've seeing that there are some core changes made in fedora 44 in how it's ssl certificates are stored, their not a monolithic cert.pem file (and accompanying .CRT files) anymore in it?, this my be preventing the .net bundled SSL libraries from working on the connection level.
I'm having a F44 VM spun up on my end and look at it in the morning after I wake up.
Potential workarounds:
Launch SM from terminal or modify its launcher shortcut to use this as its command using this env variable to direct to where the certs in f44 are stored now :
SSL_CERT_FILE=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem <path/to/StabilityMatrix.AppImage>Or, symlink it:
sudo ln -s /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /etc/pki/tls/cert.pemkiprok commentedon Jul 29, 2026
I tried the symlink and this fixed the issue.
But when i tried to install a package, like forge neo, i get the following error:
NeuralFault commentedon Jul 29, 2026
Fixing this is actually on my to-do list along with fixing this SSL issue here, and some Windows Rocm helper stuff, and will have a PR soon.
Reason being is the UV provided by SM's internal Assets directory is being passed to package pre-install in windows... but was left out of unix (linux/macos) OS condition path.
Can try installing UV at the system level in your fedora via dnf if possible, I had never caught this issue until just recently on a fresh endevourOS install where I hadn't installed UV via the package manager yet (as i dont use forge-neo, so my own checks and experience on it are sporadic). This can also explain why a similar error happens in SD.Next on linux installs... but it wasn't a hard blocker like with forge-neo.
In regards to the SSL cert issue specifically, going to add in a directory check at the start of launch before any http calls are made in SM to scan the possible directories the cert store is at, as several of the different main distros place them differently, and have it set SSL_CERT_FILE internally so it is used for the whole SM execution session and any processes ran under it.
The release builds of SM are built using Ubuntu in the github jobs path, so the cert store where DotNet's internal SSL libraries look for it are based on that, which is different from where Fedora is storing them now.
kiprok commentedon Jul 29, 2026
I want to thank you again for all the help.
I installed uv via dnf, but the same error persisted. I also tried different packages, the same error happened when i tried to install comfyUI, SD.Next and reForge.