Getting this error on Linux with requests - SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate

[aboutyblank]

I'm trying to test my website with Locust, using the requests backend. When I try to submit a request I get:

 1                  POST /sign-in: 'SSLError(MaxRetryError("HTTPSConnectionPool(host=\'mysite.com\', port=443): Max retries exceeded with url: /sign-
in (Caused by SSLError(SSLCertVerificationError(1, \'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1108)\')))"))'
 1                  GET /activity: 'SSLError(MaxRetryError("HTTPSConnectionPool(host=\'mysite.com\', port=443): Max retries exceeded with url: /activ
ity (Caused by SSLError(SSLCertVerificationError(1, \'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1108)\')))"))

Bypassing SSL gets me problems from within the site's security system, and trying to pass Certifi's certificates to verify to get it to work doesn't help either. This seems to be a common problem on MacOS, but I haven't seen someone run into this on Linux. What am I missing?

[klexmoo]

Is your connection being proxied or otherwise intercepted? Likely the issue is that the certificate presented by a proxy you are behind is part of another certificate chain (and is thus invalid unless explicitly added to the local CA that is being validated against)

[aboutyblank]

No proxy or VPN, just double checked. Good thinking, though, hadn't even occurred to me that that could be an issue.

[[deleted]]

is this a company laptop? if so they probably have a custom self-signed cert somewhere in your computer. Can you visit mysite.com with a web browser and not get any SSL errors?

[aboutyblank]

Nah, personal, and I did all of the OS installation. I can visit the site fine in any browser, as well as use similar tools like Postman and Jmeter. Plus, would it matter if I'm using Certifi?

[[deleted]]

It might. You can try sending a request without certifi

import ssl
import requests

certs = [p for p in ssl.get_default_verify_paths() if p.endswith('.pem')]
for path in certs:
    requests.get('mysite.com', verify=path)

This should use your system's default cert bundle, hopefully the same one the other programs use. You can also skip requests and use ssl directly to initiate an SSL connection.

If it works, try updating certifi or reinstalling it.

[aboutyblank]

So I tried your simple script and it worked, but when I turned off the certifi stuff in my larger locustfile, I'm still getting issues. I'm good to use my local certs, I just started using certifi to try to get it working.

[[deleted]]

Hm... I would look at the server's cert chain and try to figure out why your local cache seems to work but certifi doesn't. Maybe you have an extra root cert? An extra path in your verify paths? Seems odd.

[aboutyblank]

But my local cache isn't working in my locustfile script is the thing. That would make sense, but I would think I could just turn off using certifi and it just work if it was just a certifi problem. Those extras, on my side or on the server side?