using self-signed certificates with requests in python

Question

Situation : The target site (a pre-prod URL, say https://my-pre-prod-site.com/login, for example) is using a self-signed certificate. From the browser, the site is accessible over https without any issues (the self-signed certificate warning is suppressed by adding the certificate to the trust store in the browser)

Problem Statement : A simple python script that makes a get call to the target site using requests fails with either of the below errors in different situations :

requests.exceptions.SSLError: [Errno 0] _ssl.c:344: error:00000000:lib(0):func(0):reason(0)

or

requests.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590) The simple script used (on the python prompt) is :

import requests
res = requests.get('https://my-pre-prod-site.com/login')

**Things already tried **

I do NOT want to skip the ssl verification. Hence, verify = false is not an option for me.
I have already used the below with the same error

res = requests.get('https://my-pre-prod-site.com/login', verify = os.path.join(os.getcwd(),'test.pem') where test.pem is a pem file created by concatenating the output of the below commands in that order :

openssl rsa -in ~/Desktop/CertPath/private.key -check

and

openssl x509 -pubkey -noout -in ~/Desktop/CertPath/certificate.pem

The script is run from ~/Desktop/CertPath so getcwd() gives the right path to the certificate.

I tried another test.pem file as well where the order of concatenation was reversed. It still throws the same error.
Have tried passing the .pem file holding the public key and the .key file holding the private key, separately (individually) as well, with the same error as the outcome.

Environment details if it helps

OS - ElCapitan Mac
Requests - 2.9.0
Python - 2.7.10
OpenSSL being used by Python - 'OpenSSL 0.9.8zg 14 July 2015'

Note - The openssl version does not seem to be an issue. Because even with an updated version of openssl, the errors are the same - tested on Ubuntu with Python 2.6 that uses the Openssl 1.x

As a workaround, maybe you can use Let's Encrypt? And your dev configuration will be closer to your prod. — Tom
– Tom, Commented Jan 17, 2016 at 10:19

user3493833 · Accepted Answer · 2017-10-10 12:17:09Z

6

This question is old but In case someone wonders off here.

You are putting the private key and public key in you test.pem. This is wrong. What verify param requires is certs which it can trust.

res = requests.get('https://my-pre-prod-site.com/login', verify = os.path.join(os.getcwd(),'test.pem')

The test.pem is supposed to contain the list of all the Trusted Certificates. But what you're providing in your test.pem is your public and private key. You're ~/Desktop/CertPath/certificate.pem file itself should go into it.

Try this:

res = requests.get('https://my-pre-prod-site.com/login', verify = '~/Desktop/CertPath/certificate.pem')

answered Oct 10, 2017 at 12:17

user3493833

3212 silver badges5 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

mpromonet · Accepted Answer · 2016-01-14 19:31:58Z

-1

In order to specify certificate for SSL verification you can use :

requests.get('https://my-pre-prod-site.com/login', cert=os.path.join(os.getcwd(),'test.pem'))

edited Jan 14, 2016 at 19:31

answered Jan 13, 2016 at 22:18

mpromonet

12.1k45 gold badges68 silver badges99 bronze badges

1 Comment

qre0ct Over a year ago

have tried that already. Does not work. The same error persists.

Collectives™ on Stack Overflow

using self-signed certificates with requests in python

2 Answers 2

Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related