PROJ: Cannot open https://cdn.proj.org/XXXXXXXXXXXX.tif

[HassanMasoomi]

why do I get these warnings and, if it's an issue, is there any way to fix it? Thanks.

library(terra)
test <- rast(ncol = 1000, nrow = 1000, xmin = -2362395, xmax = 2327655, ymin = 221265, ymax = 3267405, crs = "epsg:5070")
test[] <- rnorm(ncell(test))
proj_test <- project(test, "epsg:4326", method = "bilinear")

There were 49 warnings (use warnings() to see them)

warnings() Warning messages: 1: PROJ: Cannot open https://cdn.proj.org/ca_nrc_NA83SCRS.tif: schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN (GDAL error 1) 2: PROJ: Cannot open https://cdn.proj.org/us_noaa_FL.tif: schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN (GDAL error 1) 3: PROJ: Cannot open https://cdn.proj.org/us_noaa_cnhpgn.tif: schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN (GDAL error 1) ...

terra 1.7.55

[rhijmans]

I do not see that. Can you still reproduce it or was it a temporary glitch?

[HassanMasoomi]

No, I still get the warnings. I thought the output is still useful but I need to check further because, in the example below, it doesn't work correctly. Projecting the shapefile of California using terra and sf: 1) using terra (proj_CA) results in a wrong shape while 2) using sf (proj_CA_sf) works perfectly fine.

library(terra)

# dl and read CA shapefile
temp <- tempfile()
download.file("https://data.ca.gov/dataset/e212e397-1277-4df3-8c22-40721b095f33/resource/3db1e426-fb51-44f5-82d5-a54d7c6e188b/download/ca-state-boundary.zip",temp, mode="wb")
unzip(temp)
california_shapefile <- vect("CA_State_TIGER2016.shp")
# plot(california_shapefile)

# project using terra
proj_CA <- project(california_shapefile, "epsg:5070")
# plot(proj_CA)

# project using sf
proj_CA_sf <- vect(sf::st_transform(sf::st_as_sf(california_shapefile), 5070))
# plot(proj_CA_sf)

proj_CA <- project(california_shapefile, "epsg:5070") There were 50 or more warnings (use warnings() to see the first 50) proj_CA_sf <- vect(sf::st_transform(sf::st_as_sf(california_shapefile), 5070)) warnings() Warning messages: 1: PROJ: Cannot open https://cdn.proj.org/ca_nrc_NA83SCRS.tif: schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN (GDAL error 1) 2: PROJ: Cannot open https://cdn.proj.org/ca_nrc_ABCSRSV4.tif: schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN (GDAL error 1) 3: PROJ: Cannot open https://cdn.proj.org/ca_nrc_SK83-98.tif: schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN (GDAL error 1) 4: PROJ: Cannot open https://cdn.proj.org/us_noaa_ethpgn.tif: schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN (GDAL error 1) ...

original shape (california_shapefile):

terra projected shape (proj_CA):

sf projected shape (proj_CA_sf):

[rhijmans]

Can you provide some info about your system, such as sessionInfo(). Are you using some special configuration under which you run R?

[rhijmans]

And does this work

pCA <- project(california_shapefile, 
      "+proj=aea +lat_0=23 +lon_0=-96 +lat_1=29.5 +lat_2=45.5 +x_0=0 +y_0=0 +datum=NAD83")

[HassanMasoomi]

sessionInfo() R version 4.3.1 (2023-06-16 ucrt) Platform: x86_64-w64-mingw32/x64 (64-bit) Running under: Windows 10 x64 (build 19045) Matrix products: default locale: [1] LC_COLLATE=English_United States.utf8 LC_CTYPE=English_United States.utf8 LC_MONETARY=English_United States.utf8 [4] LC_NUMERIC=C LC_TIME=English_United States.utf8
time zone: America/Los_Angeles tzcode source: internal attached base packages: [1] stats graphics grDevices utils datasets methods base
other attached packages: [1] terra_1.7-55 loaded via a namespace (and not attached): [1] utf8_1.2.3 R6_2.5.1 codetools_0.2-19 tidyselect_1.2.0 e1071_1.7-13 magrittr_2.0.3
[7] glue_1.6.2 tibble_3.2.1 KernSmooth_2.23-21 pkgconfig_2.0.3 generics_0.1.3 dplyr_1.1.4
[13] lifecycle_1.0.3 classInt_0.4-10 sf_1.0-14 cli_3.6.1 fansi_1.0.4 vctrs_0.6.4
[19] grid_4.3.1 DBI_1.1.3 proxy_0.4-27 class_7.3-22 compiler_4.3.1 tools_4.3.1
[25] pillar_1.9.0 Rcpp_1.0.11 rlang_1.1.1 units_0.8-3

I also tried the code below you provided and I am getting the same wrong projected shapefile (i.e., the same as proj_CA above).

pCA <- project(california_shapefile, "+proj=aea +lat_0=23 +lon_0=-96 +lat_1=29.5 +lat_2=45.5 +x_0=0 +y_0=0 +datum=NAD83")

There were 12 warnings (use warnings() to see them) warnings() Warning messages: 1: PROJ: Cannot open https://cdn.proj.org/us_noaa_hihpgn.tif: schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN (GDAL error 1) 2: PROJ: Cannot open https://cdn.proj.org/us_noaa_pvhpgn.tif: schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN (GDAL error 1) 3: PROJ: Cannot open https://cdn.proj.org/us_noaa_cshpgn.tif: schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN (GDAL error 1) 4: Network error when accessing a remote resource (GDAL error 1) 5: PROJ: Cannot open https://cdn.proj.org/us_noaa_cnhpgn.tif: schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN (GDAL error 1) 6: Network error when accessing a remote resource (GDAL error 1) 7: PROJ: Cannot open https://cdn.proj.org/us_noaa_WO.tif: schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN (GDAL error 1) 8: Network error when accessing a remote resource (GDAL error 1) 9: PROJ: Cannot open https://cdn.proj.org/us_noaa_nvhpgn.tif: schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN (GDAL error 1) 10: Network error when accessing a remote resource (GDAL error 1) 11: PROJ: Cannot open https://cdn.proj.org/us_noaa_azhpgn.tif: schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN (GDAL error 1) 12: Network error when accessing a remote resource (GDAL error 1)

[brownag]

Hi. I have seen errors like this before, but can't reproduce myself right now.

I think there is a problem during SSL verification that is causing the GDAL/PROJ errors. When you call project() PROJ is using remote grids stored on CDN (Content Delivery Network) storage because they are not available locally.

The certificate trust error could be caused by being behind firewall or proxy in which case you would need to speak to whoever manages that. Another option would be to set up PROJ to use local versions of the files needed for these types of conversions.

To get around this on the client side, and still use CDN sources, you may need to point curl at a file with your trusted certificates, or toggle environment variables a bit. Since your sessionInfo shows you are on Windows, you may need something like this:

Sys.setenv("GDAL_HTTP_USE_CAPI_STORE"="YES")

Or you may need to disable verification entirely (it might "work")

Sys.setenv("GDAL_HTTP_UNSAFESSL"="YES")

It is probably not a good idea to use GDAL_HTTP_UNSAFESSL other than to confirm that this is your problem. From https://gdal.org/user/configoptions.html there are a few options of interest related to custom settings of CURL/SSL certificates/verification.

CURL_CA_BUNDLE=value: Set the path to the Certification Authority (CA) bundle file.
SSL_CERT_FILE=value:
...
GDAL_HTTP_SSL_VERIFYSTATUS=[YES/NO]: Defaults to NO. Whether to verify the status of SSL certificates. See https://curl.se/libcurl/c/CURLOPT_SSL_VERIFYSTATUS.html
GDAL_HTTP_USE_CAPI_STORE=[YES/NO]: Defaults to NO. (Windows only). Whether to use certificates from the Windows certificate store.
...
GDAL_HTTP_SSLCERT=<filename>: (GDAL >= 3.7) Filename of the the SSL client certificate. See https://curl.se/libcurl/c/CURLOPT_SSLCERT.html
GDAL_HTTP_SSLCERTTYPE=[PEM/DER]: (GDAL >= 3.7) Format of the SSL certificate. see https://curl.se/libcurl/c/CURLOPT_SSLCERTTYPE.html
GDAL_HTTP_SSLKEY=<filename>: (GDAL >= 3.7) Private key file for TLS and SSL client certificate. see https://curl.se/libcurl/c/CURLOPT_SSLKEY.html
...
GDAL_HTTP_UNSAFESSL=[YES/NO]: Defaults to NO. Set to "YES" to get the curl library to skip SSL host / certificate verification.

There are also similar configuration options for PROJ itself: https://proj.org/en/9.2/usage/environmentvars.html

[HassanMasoomi]

I quickly tried setting "GDAL_HTTP_USE_CAPI_STORE" and "GDAL_HTTP_UNSAFESSL" to "YES" in the environment. But, it didn't work and I still get the same results.

[edzer]

Do you also see the problems with the sf approach after setting sf_proj_network(TRUE) ?

[HassanMasoomi]

Do you also see the problems with the sf approach after setting sf_proj_network(TRUE) ?

No, in both cases (TRUE or FALSE), sf results in a desired output.

I tried below and both proj_CA_sf (from previous code above) and proj_CA_sf2 are looking fine.

sf::sf_proj_network(TRUE)
proj_CA_sf2 <- vect(sf::st_transform(sf::st_as_sf(california_shapefile), 5070))