使用Python requests模块请求HTTPS接口遇SSL证书验证失败问题

正常运行的CURL命令 #

以下两个CURL命令均可正常获取YAML内容：

curl --location -k --user "myuser" -X GET https://some_company_domain_path/cm/open-api/persistency/v1/yaml
# 输入密码后执行成功

curl --location -k --user myuser:mypassword -X GET https://some_company_domain_path/cm/open-api/persistency/v1/yaml

编写的Python代码及报错 #

基于requests官方文档编写的代码：

import requests
r = requests.get('https://some_company_domain_path/cm/open-api/persistency/v1/yaml', auth=('myuser', 'mypassword'))

运行后出现SSL证书验证失败错误：

Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 600, in urlopen
    chunked=chunked)
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 343, in _make_request
    self._validate_conn(conn)
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 839, in _validate_conn
    conn.connect()
  File "/usr/lib/python3.6/site-packages/urllib3/connection.py", line 358, in connect
    ssl_context=context)
  File "/usr/lib/python3.6/site-packages/urllib3/util/ssl_.py", line 354, in ssl_wrap_socket
    return context.wrap_socket(sock, server_hostname=server_hostname)
  File "/usr/lib64/python3.6/ssl.py", line 365, in wrap_socket
    _context=self, _session=session)
  File "/usr/lib64/python3.6/ssl.py", line 776, in __init__
    self.do_handshake()
  File "/usr/lib64/python3.6/ssl.py", line 1036, in do_handshake
    self._sslobj.do_handshake()
  File "/usr/lib64/python3.6/ssl.py", line 648, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/requests/adapters.py", line 449, in send
    timeout=timeout
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 638, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/lib/python3.6/site-packages/urllib3/util/retry.py", line 399, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='some_company_domain_path', port=443): Max retries exceeded with url: /cm/open-api/persistency/v1/yaml (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897)'),))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.6/site-packages/requests/api.py", line 75, in get
    return request('get', url, params=params, **kwargs)
  File "/usr/lib/python3.6/site-packages/requests/api.py", line 60, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/lib/python3.6/site-packages/requests/sessions.py", line 533, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python3.6/site-packages/requests/sessions.py", line 646, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python3.6/site-packages/requests/adapters.py", line 514, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='some_company_domain_path', port=443): Max retries exceeded with url: /cm/open-api/persistency/v1/yaml (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897)'),))

已尝试的其他方法 #

尝试使用HTTPDigestAuth认证，仍出现相同错误：

from requests.auth import HTTPDigestAuth
url = 'https://some_company_domain_path/cm/open-api/persistency/v1/yaml'
requests.get(url, auth=HTTPDigestAuth('myuser', 'mypassword'))

环境及限制条件 #

• 系统：Linux 4.18.0-305.45.1.el8_4.x86_64
• Python版本：3.6.8
• 无可用证书，仅能通过用户名/密码认证
• CURL命令无需证书或代理即可正常运行

解决方案需求 #

需要修改Python代码，使其绕过SSL证书验证，像CURL命令那样正常获取YAML内容。

内容的提问来源于stack exchange，提问作者Mike Duke