Python ssl.SSLCertVerificationError
Python requests/urllib3 fails with ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] unable to get local issuer certificate. Python takes its CA bundle from the certifi package. Fix: pip install --upgrade certifi. On macOS — run /Applications/Python 3.x/Install Certificates.command. Corporate proxy with MITM — export REQUESTS_CA_BUNDLE=/path/to/corporate-ca.pem.
Below: details, example, related, FAQ.
Details
- requests uses certifi.where() for the default bundle
- SSL_CERT_FILE env var — override for stdlib ssl
- REQUESTS_CA_BUNDLE — specifically for requests
- macOS Python installer doesn't set up CAs automatically — run Install Certificates.command
- verify=False disables the check (debug only!)
Example
# Update certifi
$ pip install --upgrade certifi
# macOS fix
$ /Applications/Python\ 3.12/Install\ Certificates.command
# Corporate MITM proxy — add CA
$ export REQUESTS_CA_BUNDLE=/etc/ssl/certs/corporate-mitm.pem
# Python code: explicit bundle
import requests, certifi
resp = requests.get('https://api.example.com', verify=certifi.where())
# Debug only (NEVER in prod):
resp = requests.get('https://api.example.com', verify=False)Related
Why teams trust us
How it works
Enter domain
TLS chain verified
Expiry date & vulnerabilities
What Does the SSL Check Cover?
SSL/TLS is the encryption protocol that protects data between the browser and server. Our tool analyzes the certificate, chain of trust, TLS version, and knownvulnerabilities.
Certificate Details
Issuer, validity period, signature algorithm, covered domains (SAN), and validation type (DV/OV/EV).
Chain of Trust
Full chain verification: from leaf certificate through intermediates to root CA.
TLS Analysis
Protocol version (TLS 1.2/1.3), cipher suites, Perfect Forward Secrecy (PFS) support.
Expiry Alerts
Set up a monitor — get Telegram and email alerts 30/14/7 days before expiration.
DV vs OV vs EV Certificates
- Confirms domain ownership only
- Issued in minutes automatically
- Free via Let's Encrypt
- Suitable for most websites
- Most common certificate type
- Organization (OV) or Extended Validation (EV)
- Issued in 1-5 business days
- Costs $50 to $500/year
- For finance, e-commerce, government sites
- Increases user trust
Who uses this
DevOps
SSL certificate monitoring
Security
TLS config audit
SEO
HTTPS as ranking factor
E-commerce
customer trust
Common Mistakes
www and subdomains.Best Practices
Strict-Transport-Security header forces browsers to always use HTTPS.Get more with a free account
SSL certificate monitoring, check history and alerts 30 days before expiry.
Sign up freeFrequently Asked Questions
macOS fresh install — why?
The Python.org installer ships certifi, but the system trust store is separate. Running Install Certificates.command links the bundle.
Behind corporate VPN?
Export REQUESTS_CA_BUNDLE to the corporate root CA. IT usually provides the file.
Is verify=False OK?
Debug only in dev. In prod = MITM vulnerability. Use httpbin.org with self-signed + a local CA in trust.