Python requests SSL error - certificate verify failed

Question

This code

import requests
requests.get("https://hcaidcs.phe.org.uk/WebPages/GeneralHomePage.aspx")

is giving me this error

[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:777)

I know practically nothing about SSL, but I've tried downloading the site's certificate and pointing to that file using the verify option, but it hasn't worked. Am I missing something?

The site has a bad SSL Implementation: ssllabs.com/ssltest/analyze.html?d=hcaidcs.phe.org.uk — Klaus D.
– Klaus D., Commented Oct 6, 2017 at 11:09
Does this answer your question? Python Requests throwing SSLError — ggorlen
– ggorlen, Commented Jan 12, 2023 at 22:14
check your system proxy settings, maybe you have set a unavailable proxy. — phiree
– phiree, Commented Dec 12, 2023 at 4:16

Steffen Ullrich · Accepted Answer · 2017-10-06 11:40:58Z

47

As already pointed out in a comment: the site has a bad SSL implementation as can be seen from the SSLLabs report. The main part of this report regarding your problem is:

This server's certificate chain is incomplete. Grade capped to B.

This means that the server is not sending the full certificate chain as is needed to verify the certificate. This means you need to add the missing certificates yourself when validating. For this you need to include the PEM for the missing chain certificate C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA and also for the root CA C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA info a file my_trust_store.pem and then you can call:

requests.get("https://...", verify='my_trust_store.pem')

... but I've tried downloading the site's certificate and pointing to that file using the verify option

This will not work with normal leaf certificates. Since the SSL stack of Python is based on OpenSSL and OpenSSL expects only trusted certificate authorities in the trust store (i.e. given with verify) and a server certificate is not CA certificate it will not help to add it to the trust store.

answered Oct 6, 2017 at 11:40

Steffen Ullrich

125k11 gold badges155 silver badges194 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

user85461 Over a year ago

From the SSLLabs report, you can download the complete certificate chain with intermediates and root. Click "Click here to expand" under "Certification Paths", and then click the faint download icon next to the path whose chain you'd like to download. Save this as a .pem file, and its path can be used as the argument to verify=.

MrObjectOriented Over a year ago

The last paragraph helped me solve the error finally. Thank you for mentioning it.

Luiz Felipe Lima · Accepted Answer · 2021-03-25 20:14:43Z

3

cat institution-certificate.pem >> venv/lib/python3.9/site-packages/certifi/cacert.pem

This should solve the problem if your network requires a CA

answered Mar 25, 2021 at 20:14

Luiz Felipe Lima

712 bronze badges

2 Comments

redbeam_ Over a year ago

Since I had my institution's certificate handy, this was the easiest and most robust solution.

MrChadMWood Over a year ago

I smell a handy integration with something like pypi.org/project/get-certificate-chain

alex · Accepted Answer · 2022-11-25 19:56:38Z

2

using the certifi doesn't seem to be implied, so i'll show you what made my solution:

import urllib, urllib2, ssl
import certifi

request = urllib2.Request(url=url)
kw = dict()
if url.startswith('https://'):
    certifi_context = ssl.create_default_context(cafile=certifi.where())
    kw.update(context=certifi_context)
urllib2.urlopen(request, **kw)

i found this solution and more on RealPython, here

answered Nov 25, 2022 at 19:56

alex

1,1231 gold badge12 silver badges16 bronze badges

Comments

Adil · Accepted Answer · 2022-03-09 18:34:33Z

-2

If you can avoid the certificate verification (not secure), set PYTHONHTTPSVERIFY environment variable to 0:

export PYTHONHTTPSVERIFY=0

This will skip the certificate verification.

answered Mar 9, 2022 at 18:34

Adil

2,5487 gold badges35 silver badges38 bronze badges

2 Comments

redbeam_ Over a year ago

Did not work for me. What library uses this variable? requests certainly does not.

Adil Over a year ago

@redbeam_ This turn certificate verification off which is turned on by default. You can refer access.redhat.com/articles/2039753

Collectives™ on Stack Overflow

Python requests SSL error - certificate verify failed

4 Answers 4

2 Comments

2 Comments

Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

2 Comments

2 Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related