使用Selenium-wire+Pytest运行自动化测试时出现证书验证错误

使用Python + Pytest + Selenium + Selenium Wire执行自动化测试套件时，每次运行都会出现大量证书验证错误（如下所示），尽管测试最终能通过，但运行时间被大幅拉长（翻倍甚至更久）：

DevTools listening on ws://127.0.0.1:64277/devtools/browser/45752844-8253-493e-a10e-75b31a3b2dce
[0813/205047.956:ERROR:cert_verify_proc_builtin.cc(701)] CertVerifyProcBuiltin for staging.admin.convercus.io failed:
----- Certificate i=1 (CN=Selenium Wire CA) -----
ERROR: No matching issuer found

[0813/205048.750:ERROR:cert_verify_proc_builtin.cc(701)] CertVerifyProcBuiltin for unpkg.com failed:
----- Certificate i=1 (CN=Selenium Wire CA) -----
ERROR: No matching issuer found

[0813/205050.405:ERROR:cert_verify_proc_builtin.cc(701)] CertVerifyProcBuiltin for fonts.googleapis.com failed:
----- Certificate i=1 (CN=Selenium Wire CA) -----
ERROR: No matching issuer found

[0813/205050.648:ERROR:cert_verify_proc_builtin.cc(701)] CertVerifyProcBuiltin for o146990.ingest.sentry.io failed:
----- Certificate i=1 (CN=Selenium Wire CA) -----
ERROR: No matching issuer found

[0813/205050.847:ERROR:cert_verify_proc_builtin.cc(701)] CertVerifyProcBuiltin for staging.convercus.io failed:
----- Certificate i=1 (CN=Selenium Wire CA) -----
ERROR: No matching issuer found

[0813/205050.848:ERROR:cert_verify_proc_builtin.cc(701)] CertVerifyProcBuiltin for staging.convercus.io failed:
----- Certificate i=1 (CN=Selenium Wire CA) -----
ERROR: No matching issuer found

[0813/205051.271:ERROR:cert_verify_proc_builtin.cc(701)] CertVerifyProcBuiltin for fonts.gstatic.com failed:
----- Certificate i=1 (CN=Selenium Wire CA) -----
ERROR: No matching issuer found

[0813/205053.887:ERROR:cert_verify_proc_builtin.cc(701)] CertVerifyProcBuiltin for www.googletagmanager.com failed:
----- Certificate i=1 (CN=Selenium Wire CA) -----
ERROR: No matching issuer found

[0813/205053.916:ERROR:cert_verify_proc_builtin.cc(701)] CertVerifyProcBuiltin for firebasestorage.googleapis.com failed:
----- Certificate i=1 (CN=Selenium Wire CA) -----
ERROR: No matching issuer found

[0813/205053.947:ERROR:cert_verify_proc_builtin.cc(701)] CertVerifyProcBuiltin for d29l98y0pmei9d.cloudfront.net failed:
----- Certificate i=1 (CN=Selenium Wire CA) -----
ERROR: No matching issuer found

[0813/205054.959:ERROR:cert_verify_proc_builtin.cc(701)] CertVerifyProcBuiltin for region1.google-analytics.com failed:
----- Certificate i=1 (CN=Selenium Wire CA) -----
ERROR: No matching issuer found

[0813/205055.246:ERROR:cert_verify_proc_builtin.cc(701)] CertVerifyProcBuiltin for convercus.supporthero.io failed:
----- Certificate i=1 (CN=Selenium Wire CA) -----
ERROR: No matching issuer found

[0813/205055.248:ERROR:cert_verify_proc_builtin.cc(701)] CertVerifyProcBuiltin for convercus.supporthero.io failed:
----- Certificate i=1 (CN=Selenium Wire CA) -----
ERROR: No matching issuer found

同时伴随控制台预加载提示：

[0813/205103.885:INFO:CONSOLE(0)] "The resource https://staging.admin.convercus.io/_nuxt/285572a7272e0f5cf8a4.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.", source: https://staging.admin.convercus.io/con/coupons3/add?type=REWARD&assignation_type=CAMPAIGN (0)
[0813/205103.885:INFO:CONSOLE(0)] "The resource https://staging.admin.convercus.io/_nuxt/fb3ac4e2e62a331ac0ac.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally."

原因分析 #

这些错误源于Selenium Wire生成自签名CA证书拦截HTTPS请求，但浏览器不信任该CA证书，导致每个请求都触发证书验证失败，进而拖慢测试执行速度。

解决方案 #

1. 信任Selenium Wire的CA证书 #

Selenium Wire首次运行时会在系统特定目录生成CA证书，手动将其导入浏览器信任列表即可解决：

• 执行命令获取证书路径：python -c "from seleniumwire import webdriver; print(webdriver.cert_path)"
• 打开浏览器证书管理界面，将证书导入为「受信任的根证书颁发机构」

2. 跳过特定域名的证书拦截 #

若不想全局信任CA证书，可在初始化WebDriver时指定无需拦截的域名，避免无关请求触发验证：

from seleniumwire import webdriver

options = {
    'exclude_hosts': [
        'unpkg.com',
        'fonts.googleapis.com',
        'fonts.gstatic.com',
        'www.googletagmanager.com',
        'firebasestorage.googleapis.com',
        'd29l98y0pmei9d.cloudfront.net',
        'region1.google-analytics.com',
        'convercus.supporthero.io',
        'o146990.ingest.sentry.io'
    ]
}

driver = webdriver.Chrome(seleniumwire_options=options)

3. 让浏览器忽略证书错误 #

通过ChromeOptions添加参数，强制浏览器跳过证书验证：

from seleniumwire import webdriver
from selenium.webdriver.chrome.options import Options

chrome_options = Options()
chrome_options.add_argument('--ignore-certificate-errors')
chrome_options.add_argument('--ignore-ssl-errors')

driver = webdriver.Chrome(options=chrome_options)

4. 关闭DevTools日志输出 #

DevTools日志会占用额外资源，可通过配置禁用：

from seleniumwire import webdriver
from selenium.webdriver.chrome.options import Options

chrome_options = Options()
chrome_options.add_experimental_option('excludeSwitches', ['enable-logging'])

driver = webdriver.Chrome(options=chrome_options)

总结 #

优先推荐方案1，从根本上解决证书验证问题；若无法全局信任证书，可组合使用方案2+方案4，既能跳过无关域名拦截，又能减少日志输出，大幅提升测试速度。

内容的提问来源于stack exchange，提问作者Martin M