ssl.SSLCertVerificationError：證書驗證失敗：無法獲取本地頒發者證書（_ssl.c:1108）

Question

我用下面的代碼實現了單向認證，文件ca.crt是服務器生成的

import ssl
import urllib.request

CERT_CA = './ca.crt'
context = ssl.SSLContext(ssl.PROTOCOL_TLS)
context.check_hostname = False
context.load_verify_locations(CERT_CA)
context.verify_mode = ssl.CERT_REQUIRED

server_api = 'https://xxxxxxxx'
request = urllib.request.Request(server_api, method='GET')
resp = urllib.request.urlopen(request, context=context)

但得到例外：

Traceback (most recent call last):
  File "/usr/local/lib/python3.8/urllib/request.py", line 1319, in do_open
    h.request(req.get_method(), req.selector, req.data, headers,
  File "/usr/local/lib/python3.8/http/client.py", line 1230, in request
    self._send_request(method, url, body, headers, encode_chunked)
  File "/usr/local/lib/python3.8/http/client.py", line 1276, in _send_request
    self.endheaders(body, encode_chunked=encode_chunked)
  File "/usr/local/lib/python3.8/http/client.py", line 1225, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "/usr/local/lib/python3.8/http/client.py", line 1004, in _send_output
    self.send(msg)
  File "/usr/local/lib/python3.8/http/client.py", line 944, in send
    self.connect()
  File "/usr/local/lib/python3.8/http/client.py", line 1399, in connect
    self.sock = self._context.wrap_socket(self.sock,
  File "/usr/local/lib/python3.8/ssl.py", line 500, in wrap_socket
    return self.sslsocket_class._create(
  File "/usr/local/lib/python3.8/ssl.py", line 1040, in _create
    self.do_handshake()
  File "/usr/local/lib/python3.8/ssl.py", line 1309, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1108)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "tst.py", line 20, in <module>
    resp = urllib.request.urlopen(request, context=context)
  File "/usr/local/lib/python3.8/urllib/request.py", line 222, in urlopen
    return opener.open(url, data, timeout)
  File "/usr/local/lib/python3.8/urllib/request.py", line 525, in open
    response = self._open(req, data)
  File "/usr/local/lib/python3.8/urllib/request.py", line 542, in _open
    result = self._call_chain(self.handle_open, protocol, protocol +
  File "/usr/local/lib/python3.8/urllib/request.py", line 502, in _call_chain
    result = func(*args)
  File "/usr/local/lib/python3.8/urllib/request.py", line 1362, in https_open
    return self.do_open(http.client.HTTPSConnection, req,
  File "/usr/local/lib/python3.8/urllib/request.py", line 1322, in do_open
    raise URLError(err)
urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1108)>

certifi ==2020.6.20 和urllib3 ==1.25.10

我該如何解決這個問題，請求需要身份驗證，所以請不要使用verify=False之類的東西。

非常感謝

---

問題解決了，因為我使用了錯誤的服務器主機地址。 上面的代碼對單向認證情況有效。

Answer 1

我已經能夠通過使用我向網絡管理員請求的 ca-bundle 來解決這個問題。 這被映射到REQUESTS_CA_BUNDLE環境變量：

# .bashrc
export REQUESTS_CA_BUNDLE=/path/to/cacert.pem

重新啟動終端並嘗試再次pip install