python – urllib and SSL: CERTIFICATE_VERIFY_FAILED Error

python – urllib and SSL: CERTIFICATE_VERIFY_FAILED Error

This isnt a solution to your specific problem, but Im putting it here because this thread is the top Google result for SSL: CERTIFICATE_VERIFY_FAILED, and it lead me on a wild goose chase.

If you have installed Python 3.6 on OSX and are getting the SSL: CERTIFICATE_VERIFY_FAILED error when trying to connect to an https:// site, its probably because Python 3.6 on OSX has no certificates at all, and cant validate any SSL connections. This is a change for 3.6 on OSX, and requires a post-install step, which installs the certifi package of certificates. This is documented in the file ReadMe.rtf, which you can find at /Applications/Python 3.6/ReadMe.rtf (see also the file Conclusion.rtf, and the script that generates the macOS installer).

The ReadMe will have you run the post-install script at /Applications/Python 3.6/Install Certificates.command (its source is install_certificates.command), which:

Release notes have some more info:

On newer versions of Python, there is more documentation about this:

If you just want to bypass verification, you can create a new SSLContext. By default newly created contexts use CERT_NONE.

Be careful with this as stated in section

When calling the SSLContext constructor directly, CERT_NONE is the default. Since it does not authenticate the other peer, it can be insecure, especially in client mode where most of time you would like to ensure the authenticity of the server you’re talking to. Therefore, when in client mode, it is highly recommended to use CERT_REQUIRED.

But if you just want it to work now for some other reason you can do the following, youll have to import ssl as well:

input = input.replace(!web , )      
url = + input
req = urllib2.Request(url, headers={ X-Mashape-Key: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX })
gcontext = ssl.SSLContext()  # Only for gangstars
info = urllib2.urlopen(req, context=gcontext).read()
Message.Chat.SendMessage ( + info)

This should get round your problem but youre not really solving any of the issues, but you wont see the [SSL: CERTIFICATE_VERIFY_FAILED] because you now arent verifying the cert!

To add to the above, if you want to know more about why you are seeing these issues you will want to have a look at PEP 476.

This PEP proposes to enable verification of X509 certificate signatures, as well as hostname verification for Pythons HTTP clients by default, subject to opt-out on a per-call basis. This change would be applied to Python 2.7, Python 3.4, and Python 3.5.

There is an advised opt out which isnt dissimilar to my advice above:

import ssl

# This restores the same behavior as before.
context = ssl._create_unverified_context()
urllib.urlopen(https://no-valid-cert, context=context)

It also features a highly discouraged option via monkeypatching which you dont often see in python:

import ssl

ssl._create_default_https_context = ssl._create_unverified_context

Which overrides the default function for context creation with the function to create an unverified context.

Please note with this as stated in the PEP:

This guidance is aimed primarily at system administrators that wish to adopt newer versions of Python that implement this PEP in legacy environments that do not yet support certificate verification on HTTPS connections. For example, an administrator may opt out by adding the monkeypatch above to in their Standard Operating Environment for Python. Applications and libraries SHOULD NOT be making this change process wide (except perhaps in response to a system administrator controlled configuration setting).

If you want to read a paper on why not validating certs is bad in software you can find it here!

python – urllib and SSL: CERTIFICATE_VERIFY_FAILED Error

To expand on Craig Glennies answer:

in Python 3.6.1 on MacOs Sierra

Entering this in the bash terminal solved the problem:

pip install certifi
/Applications/Python 3.6/Install Certificates.command

Leave a Reply

Your email address will not be published. Required fields are marked *