使用Python连接MongoDB时出现SSL证书验证失败错误求助

问题重现 #

代码：

from pymongo import MongoClient

uri = "mongodb+srv://root:87954389@cluster0.wuyjxer.mongodb.net/?retryWrites=true&w=majority"

client = MongoClient(uri)
db = client["Users"]
collection = db["users"]
post = {"_id": 0, "name":"User1"}
collection.insert_one(post)

错误信息：

ac-ibwngp9-shard-00-02.wuyjxer.mongodb.net:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992),ac-ibwngp9-shard-00-01.wuyjxer.mongodb.net:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992),ac-ibwngp9-shard-00-00.wuyjxer.mongodb.net:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992), Timeout: 30s, Topology Description: <TopologyDescription id: 649d994cc30ecaea12f34585, topology_type: ReplicaSetNoPrimary, servers: [<ServerDescription ('ac-ibwngp9-shard-00-00.wuyjxer.mongodb.net', 27017) server_type: Unknown, rtt: None, error=AutoReconnect('ac-ibwngp9-shard-00-00.wuyjxer.mongodb.net:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)')>, <ServerDescription ('ac-ibwngp9-shard-00-01.wuyjxer.mongodb.net', 27017) server_type: Unknown, rtt: None, error=AutoReconnect('ac-ibwngp9-shard-00-01.wuyjxer.mongodb.net:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)')>, <ServerDescription ('ac-ibwngp9-shard-00-02.wuyjxer.mongodb.net', 27017) server_type: Unknown, rtt: None, error=AutoReconnect('ac-ibwngp9-shard-00-02.wuyjxer.mongodb.net:27017: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)')>]>

解决方案 #

1. 临时跳过SSL验证（仅测试环境使用）

在创建MongoClient时添加tlsAllowInvalidCertificates=True参数，跳过证书验证：

from pymongo import MongoClient

uri = "mongodb+srv://root:87954389@cluster0.wuyjxer.mongodb.net/?retryWrites=true&w=majority"
client = MongoClient(uri, tlsAllowInvalidCertificates=True)
# 后续代码不变
db = client["Users"]
collection = db["users"]
post = {"_id": 0, "name":"User1"}
collection.insert_one(post)

⚠️ 注意：此方法会关闭SSL证书校验，存在安全风险，绝对禁止在生产环境使用。

2. 配置合法CA证书（生产环境推荐）

下载MongoDB Atlas认可的CA证书（可从MongoDB Atlas控制台获取，或直接使用系统默认根证书），然后在连接时指定证书路径：

client = MongoClient(uri, tlsCAFile="/absolute/path/to/ca-certificate.crt")

常见系统默认根证书路径：

• Linux：/etc/ssl/certs/ca-certificates.crt
• MacOS：/usr/local/etc/openssl/cert.pem
• Windows：C:\Windows\System32\certificates\root\ca.pem

3. 修复Python环境证书问题（针对MacOS用户）

如果是MacOS自带或手动安装的Python缺少根证书，可运行Python安装目录下的证书安装脚本：
打开终端，执行对应版本的命令（以Python 3.10为例）：

/Library/Frameworks/Python.framework/Versions/3.10/bin/Install Certificates.command

运行后会更新Python的根证书库，解决证书验证问题。

4. 检查网络代理

如果处于代理网络环境，代理可能拦截了SSL证书。尝试关闭代理，或配置代理的CA证书到MongoDB连接参数中。

内容的提问来源于stack exchange，提问作者Dima