使用Requests包调用GitHub API时遇SSL证书验证失败问题求助

问题描述 #

我在PyCharm中使用Python 3.12开发，已通过pip安装Requests v2.31，执行以下代码时遭遇SSL证书验证失败错误：

import requests
r = requests.get('https://api.github.com/events')

错误栈如下：

Traceback (most recent call last):
  File "C:\Users\mfischer\PycharmProjects\NewProject\venv\Lib\site-packages\urllib3\connectionpool.py", line 467, in _make_request
    self._validate_conn(conn)
  File "C:\Users\mfischer\PycharmProjects\NewProject\venv\Lib\site-packages\urllib3\connectionpool.py", line 1096, in _validate_conn
    conn.connect()
  File "C:\Users\mfischer\PycharmProjects\NewProject\venv\Lib\site-packages\urllib3\connection.py", line 642, in connect
    sock_and_verified = _ssl_wrap_socket_and_match_hostname(
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\mfischer\PycharmProjects\NewProject\venv\Lib\site-packages\urllib3\connection.py", line 782, in _ssl_wrap_socket_and_match_hostname
    ssl_sock = ssl_wrap_socket(
               ^^^^^^^^^^^^^^^^
  File "C:\Users\mfischer\PycharmProjects\NewProject\venv\Lib\site-packages\urllib3\util\ssl_.py", line 470, in ssl_wrap_socket
    ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\mfischer\PycharmProjects\NewProject\venv\Lib\site-packages\urllib3\util\ssl_.py", line 514, in _ssl_wrap_socket_impl
    return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\mfischer\AppData\Local\Programs\Python\Python312\Lib\ssl.py", line 455, in wrap_socket
    return self.sslsocket_class._create(
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\mfischer\AppData\Local\Programs\Python\Python312\Lib\ssl.py", line 1046, in _create
    self.do_handshake()
  File "C:\Users\mfischer\AppData\Local\Programs\Python\Python312\Lib\ssl.py", line 1317, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\Users\mfischer\PycharmProjects\NewProject\venv\Lib\site-packages\urllib3\connectionpool.py", line 790, in urlopen
    response = self._make_request(
               ^^^^^^^^^^^^^^^^^^^
  File "C:\Users\mfischer\PycharmProjects\NewProject\venv\Lib\site-packages\urllib3\connectionpool.py", line 491, in _make_request
    raise new_e
urllib3.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "C:\Users\mfischer\PycharmProjects\NewProject\venv\Lib\site-packages\requests\adapters.py", line 486, in send
    resp = conn.urlopen(
           ^^^^^^^^^^^^^
  File "C:\Users\mfischer\PycharmProjects\NewProject\venv\Lib\site-packages\urllib3\connectionpool.py", line 844, in urlopen
    retries = retries.increment(
              ^^^^^^^^^^^^^^^^^^
  File "C:\Users\mfischer\PycharmProjects\NewProject\venv\Lib\site-packages\urllib3\util\retry.py", line 515, in increment
    raise MaxRetryError(_pool, url, reason) from reason  # type: ignore[arg-type]
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='api.github.com', port=443): Max retries exceeded with url: /events (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\Users\mfischer\PycharmProjects\NewProject\main.py", line 2, in <module>
    r = requests.get('https://api.github.com/events')
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\mfischer\PycharmProjects\NewProject\venv\Lib\site-packages\requests\api.py", line 73, in get
    return request("get", url, params=params, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\mfischer\PycharmProjects\NewProject\venv\Lib\site-packages\requests\api.py", line 59, in request
    return session.request(method=method, url=url, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\mfischer\PycharmProjects\NewProject\venv\Lib\site-packages\requests\sessions.py", line 589, in request
    resp = self.send(prep, **send_kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\mfischer\PycharmProjects\NewProject\venv\Lib\site-packages\requests\sessions.py", line 703, in send
    r = adapter.send(request, **kwargs)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\mfischer\PycharmProjects\NewProject\venv\Lib\site-packages\requests\adapters.py", line 517, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='api.github.com', port=443): Max retries exceeded with url: /events (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)')))

Process finished with exit code 1

解决方案 #

1. 临时绕过SSL验证（仅测试环境使用） #

如果仅用于测试，可以在请求中添加verify=False参数跳过证书验证：

import requests
r = requests.get('https://api.github.com/events', verify=False)

⚠️ 注意：此方法关闭SSL安全验证，禁止在生产环境使用，存在中间人攻击风险。

2. 配置信任根证书 #

错误核心是Python环境无法识别系统根证书，可手动指定证书路径：

• 找到系统根证书文件（Windows下通常为C:\Windows\System32\certificates\root\ca-bundle.crt，或从浏览器导出GitHub的证书链）
• 在请求中指定证书路径：

import requests
r = requests.get('https://api.github.com/events', verify='path/to/your/ca-bundle.crt')

也可设置环境变量REQUESTS_CA_BUNDLE指向证书文件，让所有Requests请求自动使用该证书。

3. 更新certifi库 #

Requests依赖certifi库提供根证书列表，更新该库可获取最新信任证书：
在PyCharm终端执行：

pip install --upgrade certifi

更新后，Requests会自动使用certifi提供的最新根证书，通常能解决多数证书验证问题。

4. 检查代理设置 #

若处于公司/学校网络，可能是代理服务器证书未被信任。可配置代理并指定代理证书：

import requests
proxies = {
    'http': 'http://your-proxy:port',
    'https': 'https://your-proxy:port',
}
r = requests.get('https://api.github.com/events', proxies=proxies, verify='path/to/proxy-cert.crt')

或联系网络管理员获取合法代理证书并添加到系统信任列表。

内容的提问来源于stack exchange，提问作者walleye2416