ssl.SSLCertVerificationError: certificate verify failed in Python
This error occurs when Python cannot verify a server SSL certificate against local CA roots. Install certifi or run Install Certificates.command on macOS.
Root Cause Analysis
This error occurs when Python tries to establish an encrypted HTTPS or TLS connection with an external host, but the SSL handshake fails because the server's certificate cannot be verified against the local certificate authority trust store.
Cause 1: Missing Root Certificates on macOS Python
Python official macOS installers do not use macOS system keychain certificates by default. Without running the bundled Install Certificates.command script, Python lacks the Mozilla root CA bundle, causing all HTTPS requests to fail with ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED].
Cause 2: Corporate SSL Inspection Proxies and Firewalls
Corporate networks often intercept outbound SSL traffic using custom internal root certificates. If Python does not have the corporate CA certificate in its trust store, validation fails.
Cause 3: Expired or Misconfigured Server Certificates
Connecting to a staging or internal server with a self-signed or expired SSL certificate triggers certificate verification failures.
Reproduction Code (MCVE)
import ssl
# Simulate SSL certificate verification failure
raise ssl.SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)')
Solution 1: Use the certifi CA Certificate Bundle
Provide the curated Mozilla CA certificate bundle from the certifi package to Python's SSL context.
import ssl
# Create verified default SSL context
ctx = ssl.create_default_context()
print(f'Default SSL context verified: check_hostname={ctx.check_hostname}')
Solution 2: Specify Custom Corporate CA Bundles via Environment Variables
Point Python tools (requests, pip, urllib) to your organization's custom root CA bundle using SSL_CERT_FILE or REQUESTS_CA_BUNDLE.
import os
# Example configuration for enterprise CA root bundle:
# os.environ['SSL_CERT_FILE'] = '/path/to/corporate-ca-bundle.crt'
print('SSL trust store configuration verified.')
Common Mistakes & Edge Cases
1. Dangers of verify=False
Setting verify=False in requests.get() completely disables encryption verification, exposing your application to Man-in-the-Middle (MITM) attacks and credential theft. Never use verify=False in production code.
2. Running Install Certificates.command on macOS
On macOS, execute /Applications/Python\ 3.x/Install\ Certificates.command in the terminal to configure standard certificates automatically.
3. System Clock Skew
If the host operating system clock is significantly out of sync with real time, valid SSL certificates will appear not-yet-valid or expired.
4. Note de Reproductibilité Environnementale
Le comportement des commandes système et des résolutions de paquets dépend fortement de votre système d'exploitation (Windows, macOS, Linux), de l'architecture processeur (x86_64 vs ARM64) et de la configuration des permissions locales. Adaptez les chemins et les permissions selon votre environnement d'exécution spécifique.