How to Fix the CERTIFICATE_VERIFY_FAILED Error in Python Requests

Learn why your Python requests fail with SSL errors and how to resolve the `CERTIFICATE_VERIFY_FAILED` issue when using self-signed certificates.
---

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: Curl call works, but Python request call fails with [SSL: CERTIFICATE_VERIFY_FAILED]

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
Understanding the CERTIFICATE_VERIFY_FAILED Error in Python Requests

If you've ever encountered the SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] error while using Python's requests library, you're not alone. This error can be perplexing, especially when your curl command works without any issues. In this guide, we will clearly explain the problem and provide a detailed solution to avoid SSL validation issues when dealing with self-signed certificates.

The Problem

You are trying to access an internal address using a self-signed certificate, and while the following curl command works perfectly:

[[See Video to Reveal this Text or Code Snippet]]

You get a 200 status without any concerns. However, when attempting the same request in Python:

[[See Video to Reveal this Text or Code Snippet]]

You receive the following error:

[[See Video to Reveal this Text or Code Snippet]]

You may have even noticed that using curl from a Python subprocess works, and while you could ignore the certificate verification in Python, this is not secure for your use case.

Why is This Happening?

The root of the issue lies in how the curl command and the Python requests library handle certificate verification. When you provide a certificate file with curl using the -cacert option, it does not always require a full verification chain. On the other hand, Python checks for the entire certificate chain, which includes the root CA and any intermediates. This may lead to an error if you're only providing an intermediate certificate.

Solution: Providing the Full Certificate Chain

After some investigation, we've identified the solution to your problem. To resolve the CERTIFICATE_VERIFY_FAILED error, follow these steps:

Identify the required certificates: Ensure you have access to the root CA certificate. It's crucial to provide this to the Python requests library to complete the verification chain successfully.

Combine Certificates (if needed): If you have intermediate certificates, you might need to create a bundle that includes both the intermediate and root certificates. This can typically be done by concatenating the certificates into one .crt file or using a single file that contains the full chain.

Update your Python request: When making the request, specify the path to this bundle of certificates. Here's how your Python request should look:

[[See Video to Reveal this Text or Code Snippet]]

Summary

By providing the correct certificate chain, including both intermediate and root CAs, you can solve the CERTIFICATE_VERIFY_FAILED error in your requests calls without compromising your security setting. This is particularly vital when dealing with internal services using self-signed certificates.

Now you're all set to securely connect to your internal services using Python's requests library!' Enjoy coding!