Python ssl.SSLCertVerificationError

• requests uses certifi.where() for the default bundle
• SSL_CERT_FILE env var — override for stdlib ssl
• REQUESTS_CA_BUNDLE — specifically for requests
• macOS Python installer doesn't set up CAs automatically — run Install Certificates.command
• verify=False disables the check (debug only!)

# Update certifi
$ pip install --upgrade certifi

# macOS fix
$ /Applications/Python\ 3.12/Install\ Certificates.command

# Corporate MITM proxy — add CA
$ export REQUESTS_CA_BUNDLE=/etc/ssl/certs/corporate-mitm.pem

# Python code: explicit bundle
import requests, certifi
resp = requests.get('https://api.example.com', verify=certifi.where())

# Debug only (NEVER in prod):
resp = requests.get('https://api.example.com', verify=False)

• curl (77)
• Java PKIX

The ssl.SSLCertVerificationError: CERTIFICATE_VERIFY_FAILED error in Python indicates that the SSL certificate presented by a server is not trusted. This typically occurs due to expired certificates, self-signed certificates, or missing root certificates in the certificate chain. To resolve this, ensure the server's SSL certificate is valid and trusted, and update your local certificate store if necessary.

When encountering the ssl.SSLCertVerificationError: CERTIFICATE_VERIFY_FAILED error, it's essential to understand the various factors that can trigger this issue. Here are the most common causes:

• Expired Certificates: SSL certificates have a specific validity period. If the certificate has expired, clients will reject the connection.
• Self-Signed Certificates: While self-signed certificates can be used for development, they are not trusted by default in production environments. This can lead to verification failures.
• Missing Intermediate Certificates: If the server does not provide the complete certificate chain, clients may fail to verify the server's identity, resulting in an error.
• Outdated Certificate Authorities (CAs): If your local certificate store does not have the latest CA certificates, it may not trust the SSL certificate presented by the server.
• Hostname Mismatch: The domain name in the SSL certificate must match the domain being accessed. A mismatch can cause verification to fail.

Understanding these causes is crucial for troubleshooting and resolving the CERTIFICATE_VERIFY_FAILED error effectively.

To resolve the ssl.SSLCertVerificationError: CERTIFICATE_VERIFY_FAILED error, you can take several practical steps. Here’s a structured approach to troubleshooting:

1. Check the SSL Certificate Expiry: Use the following command to check the SSL certificate's expiration date:

openssl s_client -connect example.com:443 -servername example.com

Replace example.com with the domain you are trying to access. Look for the notAfter field to see the expiration date.

1. Verify the Certificate Chain: Ensure that the server provides the complete certificate chain. You can check this with:

openssl s_client -connect example.com:443 -showcerts

This command will display the entire certificate chain. Ensure that all certificates are valid and properly linked.

1. Update Your Local CA Certificates: If the error persists, your local CA certificates might be outdated. On Debian-based systems, you can update them with:

sudo apt-get update && sudo apt-get install --reinstall ca-certificates

For Red Hat-based systems, use:

sudo yum update ca-certificates

1. Use a Trusted Certificate: If you are using a self-signed certificate for development purposes, consider switching to a trusted certificate authority for production. Services like Let's Encrypt provide free SSL certificates that are widely trusted.

1. Bypass SSL Verification (Not Recommended): If you need a temporary workaround, you can disable SSL verification in Python. However, this is not recommended for production environments:

import ssl
ssl._create_default_https_context = ssl._create_unverified_context

This will bypass SSL verification but expose your application to security risks.

By following these steps, you can systematically identify and resolve the ssl.SSLCertVerificationError: CERTIFICATE_VERIFY_FAILED error, ensuring secure connections to your servers.