Why do HTTPS requests produce SSL CERTIFICATE_VERIFY_FAILED error?

Question

Here is my Python code:

    import requests
    requests.get('https://google.com')

This is the error:

requests.exceptions.SSLError: HTTPSConnectionPool(host='google.com', port=443):
Max retries exceeded with url: / (Caused by SSLError(SSLError(1, 
'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:833)'),))

Using Insomnia gives me an error related with certificates:

My OS is Windows 7 Professional.

requests.get('https://google.com') – rayashi Aug 09 '18 at 13:37 — rayashi, Aug 09 '18 at 13:37
I don't think it's related with the code – rayashi Aug 09 '18 at 13:38 — rayashi, Aug 09 '18 at 13:38

Hagai Wild · Accepted Answer · 2018-08-09T13:40:58.053

95

requests.get('https://google.com', verify='/path/to/certfile')

or you can skip verifications by doing this:

requests.get('https://google.com', verify=False)

You should specify your CA.

edited Aug 09 '18 at 13:40

answered Aug 09 '18 at 13:38

Hagai Wild

1,904
11
19

Yesterday I was able to request without passing this parameter, By the way how can I get a google domain certificate ? – rayashi Aug 09 '18 at 13:40
I'm consuming from a API that I don't have the control. And why other softawers can't make a HTTPS requests ? – rayashi Aug 09 '18 at 13:43
1

I've tried it without specifying CA and it worked as well, which is weird. – Hagai Wild Aug 09 '18 at 13:48
1

Yes, I tryed this same code in another machine. And guess what? It's worked. – rayashi Aug 09 '18 at 13:49
Just use `verify=False` to ignore the ssl. – Hagai Wild Aug 09 '18 at 13:50
1

But I'm using some lib that uses request internaly.. And I can't change the code. And what about the http clients like Insomnia? I think there are some problems with the SO – rayashi Aug 09 '18 at 13:55
In the browser I can request HTTPS – rayashi Aug 09 '18 at 14:00
I think should change requests.get('https://google.com', verify='/path/to/certfile') to requests.get('https://google.com', verify= True, cert=['path/to/cert/files]) – r.a.shehni Sep 08 '22 at 12:06

score 5 · Answer 2 · answered Jun 16 '21 at 07:18

5

If you are running under business network, contact the network administrator to apply required configurations at the network level.

answered Jun 16 '21 at 07:18

Rola

1,598
13
12

2

I think this may be my issue. What configurations would these be? – Python Developer Aug 17 '21 at 01:36

user13476428 · Answer 3 · 2020-05-14T11:05:31.397

4

This fixed it: Python referencing old SSL version

The openssl versions used to differ for python and the one offered by homebrew

if brew install python --with-brewd-openssl doesn't work try
brew install openssl brew install python
after uninstalling python

edited May 14 '20 at 11:05

answered May 14 '20 at 10:55

user13476428

71
1
1
3

score 2 · Answer 4 · answered Jun 03 '21 at 06:30

2

You might add header and verify argument to by-pass ssl certificate security.

r = requests.get(URL, headers = {'User-agent': 'your bot 0.1'}, verify=False)

You should specify path your certificate if you have.

answered Jun 03 '21 at 06:30

HITESH GUPTA

149
4

This will, of course, remove the benefits SSL certificates give you, including verification that you are actually talking to the server you think you do, and are not being affected by a man-in-the-middle attack. – Daniel Werner Sep 07 '21 at 22:12

haddagart · Answer 5 · 2022-03-07T18:05:58.643

2

In the requests.get you can set the verify flag to False. This way the handshake between the program and the server is going to be ignored.

-- This isn't a guaranteed method because some servers have strict policy to deliver responses to requests.

edited Mar 07 '22 at 18:05

answered Sep 07 '21 at 20:08

haddagart

68
1
8

score 2 · Answer 6 · answered Feb 15 '23 at 10:04

2

If you using proxy server,add proxy to your requests. just like:

proxies = {'http':'http://localhost:port','https':'http://localhost:port'}
requests.get('your_request_website', headers=headers, proxies=proxies)

hope this helps.

answered Feb 15 '23 at 10:04

liaoyk

21
2

where do you find localhost:port if are not specified ? – minattosama Feb 24 '23 at 16:12

score -1 · Answer 7 · answered Apr 12 '21 at 07:18

-1

I resolved my problem by installing openssl you can go here and download the Light version or any version suited to your needs: https://slproweb.com/products/Win32OpenSSL.html

answered Apr 12 '21 at 07:18

helloWORLD

135
5

Why do HTTPS requests produce SSL CERTIFICATE_VERIFY_FAILED error?

7 Answers7

Linked