SSL错误：例程：SSL3_GET_SERVER_CERTIFICATE：证书验证失败

Question

I have a large number of file download links in a txt file. I am trying to write a python script to download all the files at once, but I end up with the following error:

SSLError: [Errno 1] _ssl.c:499: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 

The file is being downloaded via intranet.

I tried to download the file via browser and I got a pop up with some certificate . I tried to google it but didn't find a way to solve this.

Answer 1

The server certificate is invalid, either because it is signed by an invalid CA (internal CA, self signed,...), doesn't match the server's name or because it is expired.

Either way, you need to find how to tell to the Python library that you are using that it must not stop at an invalid certificate if you really want to download files from this server.

Answer 2

Experienced this myself when using requests :

This is extremely insecure; use only as a last resort! (See rdlowrey's comment.)

requests.get('https://github.com', verify=True)

Making that verify=False did the trick for me.

Answer 3

Got this issue today and after wandering for several hours just came to know that my server datetime was wrong.

So first please check your server datetime before going so deep in this issue.

also try doing

>> sudo update-ca-certificates

Answer 4

Got this same error recently in a python app using requests on ubuntu 14.04LTS, that I thought had been running fine (maybe it was and some update occurred). Doing the steps below fixed it for me:

pip install --upgrade setuptools
pip install -U requests[security]

Here is a reference: https://stackoverflow.com/a/39580231/996117

Answer 5

当你的当地时间关闭时（例如在证书验证时间之前）也可能发生，我的错误就是这种情况......

Answer 6

I've experienced the same issue because of certifi library. Installing a different version helped me as well.

Answer 7

Normally updating certifi and/or the certifi cacert.pem file would work. I also had to update my version of python. Vs. 2.7.5 wasn't working because of how it handles SNI requests.

Once you have an up to date pem file you can make your http request using:

requests.get(url, verify='/path/to/cacert.pem')