Python中astroquery访问NASA Horizons的SSL证书异常排查与解决

问题背景 #

一段使用astroquery调用NASA Horizons的Python代码已稳定运行2年，近期突然触发SSL证书验证失败错误。尝试调用Horizons.clear_cache()清理缓存、查找本地缓存文件均无效，Mac和Windows平台均出现该问题。

复现代码 #

from astroquery.jplhorizons import Horizons
target = Horizons(id=299, location=662, epochs=[{'2025-02-06 01:47:13'}])
print(target)
eph = target.ephemerides()

错误信息 #

JPLHorizons instance "299"; location=662, epochs=[{'2025-02-06 01:47:13'}], id_type=None
Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/site-packages/urllib3/connectionpool.py", line 603, in urlopen
    chunked=chunked)
  File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/site-packages/urllib3/connectionpool.py", line 344, in _make_request
    self._validate_conn(conn)
  File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/site-packages/urllib3/connectionpool.py", line 843, in _validate_conn
    conn.connect()
  File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/site-packages/urllib3/connection.py", line 370, in connect
    ssl_context=context)
  File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/site-packages/urllib3/util/ssl_.py", line 355, in ssl_wrap_socket
    return context.wrap_socket(sock, server_hostname=server_hostname)
  File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/ssl.py", line 412, in wrap_socket
    session=session
  File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/ssl.py", line 853, in _create
    self.do_handshake()
  File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/ssl.py", line 1117, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1056)

问题原因 #

NASA Horizons更新了由Entrust签发的SSL证书，2024年11月后谷歌等厂商对这类新签发的证书做了限制，导致Python依赖的certifi库旧版本无法识别新证书，进而触发验证失败。

解决方案 #

Windows（Anaconda环境） #

打开Anaconda Navigator，进入目标环境页面，搜索certifi并更新所有可更新的实例。

Mac（pip安装的Python） #

1. 执行以下代码确认证书路径：

from requests.utils import DEFAULT_CA_BUNDLE_PATH
print(DEFAULT_CA_BUNDLE_PATH)
# 示例输出：/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/site-packages/certifi/cacert.pem

2. 执行命令升级certifi：

pip3 install certifi --upgrade

内容的提问来源于stack exchange，提问作者DVC