如何解决Selenium与ChromeDriverManager的证书验证失败问题

问题背景 #

在安装Zscaler的Windows企业电脑（Python 3.10环境）中，运行Selenium基础脚本时出现certificate verify failed: unable to get local issuer certificate错误。尝试执行webdriver-manager update --ignore_ssl=true命令时，系统提示找不到该命令。

原代码 #

from selenium import webdriver
from selenium.webdriver.chrome.service import Service
from selenium.webdriver.chrome.options import Options
from webdriver_manager.chrome import ChromeDriverManager

def openChrome():
    options= Options()
    options.add_experimental_option("detach", True)
    driverweb= webdriver.Chrome(service=Service(ChromeDriverManager().install()), options= options)
    driverweb.get('https://pypi.org/', verify=False)
    driverweb.set_window_size(1000,700)
    driverweb.set_window_position(0,0)

openChrome()

完整报错信息 #

Traceback (most recent call last):
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\site-packages\urllib3\connectionpool.py", line 703, in urlopen
    httplib_response = self._make_request(
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\site-packages\urllib3\connectionpool.py", line 386, in _make_request
    self._validate_conn(conn)
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\site-packages\urllib3\connectionpool.py", line 1042, in _validate_conn
    conn.connect()
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\site-packages\urllib3\connection.py", line 414, in connect
    self.sock = ssl_wrap_socket(
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\site-packages\urllib3\util\ssl_.py", line 449, in ssl_wrap_socket
    ssl_sock = _ssl_wrap_socket_impl(
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\site-packages\urllib3\util\ssl_.py", line 493, in _ssl_wrap_socket_impl
    return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\ssl.py", line 512, in wrap_socket
    return self.sslsocket_class._create(
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\ssl.py", line 1070, in _create
    self.do_handshake()
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\ssl.py", line 1341, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\site-packages\requests\adapters.py", line 489, in send
    resp = conn.urlopen(
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\site-packages\urllib3\connectionpool.py", line 787, in urlopen
    retries = retries.increment(
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\site-packages\urllib3\util\retry.py", line 592, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='chromedriver.storage.googleapis.com', port=443): Max retries exceeded with url: /109.0.5414/chromedriver_win32.zip (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\Users\201046329\Desktop\testwebbrowser.py", line 17, in <module>
    openChrome()
  File "C:\Users\201046329\Desktop\testwebbrowser.py", line 12, in openChrome
    driverweb= webdriver.Chrome(service=Service(ChromeDriverManager().install()), options= options)
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\site-packages\webdriver_manager\chrome.py", line 39, in install
    driver_path = self._get_driver_path(self.driver)
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\site-packages\webdriver_manager\core\manager.py", line 30, in _get_driver_path
    file = self._download_manager.download_file(driver.get_url())
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\site-packages\webdriver_manager\core\download_manager.py", line 28, in download_file
    response = self._http_client.get(url)
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\site-packages\webdriver_manager\core\http.py", line 32, in get
    resp = requests.get(url=url, verify=self._ssl_verify, stream=True, **kwargs)
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\site-packages\requests\api.py", line 73, in get
    return request("get", url, params=params, **kwargs)
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\site-packages\requests\api.py", line 59, in request
    return session.request(method=method, url=url, **kwargs)
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\site-packages\requests\sessions.py", line 587, in request
    resp = self.send(prep, **send_kwargs)
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\site-packages\requests\sessions.py", line 701, in send
    r = adapter.send(request, **kwargs)
  File "C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\site-packages\requests\adapters.py", line 563, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='chromedriver.storage.googleapis.com', port=443): Max retries exceeded with url: /109.0.5414/chromedriver_win32.zip (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)')))

适配场景的解决方案 #

方案1：给WebDriverManager禁用SSL验证 #

修改ChromeDriverManager的初始化参数，直接关闭SSL验证，这是最快捷的解决方式：

from selenium import webdriver
from selenium.webdriver.chrome.service import Service
from selenium.webdriver.chrome.options import Options
from webdriver_manager.chrome import ChromeDriverManager

def openChrome():
    options= Options()
    options.add_experimental_option("detach", True)
    # 添加ssl_verify=False参数关闭SSL验证
    driverweb= webdriver.Chrome(service=Service(ChromeDriverManager(ssl_verify=False).install()), options= options)
    driverweb.get('https://pypi.org/')
    driverweb.set_window_size(1000,700)
    driverweb.set_window_position(0,0)

openChrome()

注意：driverweb.get()方法没有verify参数，原代码里的verify=False是无效的，需要删除。

方案2：手动下载ChromeDriver并指定路径 #

绕过WebDriverManager的自动下载，手动管理驱动：

1. 打开Chrome浏览器，在地址栏输入chrome://version/查看当前Chrome版本。
2. 下载对应版本的ChromeDriver，解压后放到本地固定路径（比如C:\drivers\chromedriver.exe）。
3. 修改代码，直接指定驱动路径：

from selenium import webdriver
from selenium.webdriver.chrome.service import Service
from selenium.webdriver.chrome.options import Options

def openChrome():
    options= Options()
    options.add_experimental_option("detach", True)
    # 直接指定本地ChromeDriver路径
    driverweb= webdriver.Chrome(service=Service(r'C:\drivers\chromedriver.exe'), options= options)
    driverweb.get('https://pypi.org/')
    driverweb.set_window_size(1000,700)
    driverweb.set_window_position(0,0)

openChrome()

方案3：导入Zscaler根证书到Python证书库 #

从根本上解决企业代理证书的验证问题：

1. 打开Chrome浏览器，访问任意HTTPS网站，点击地址栏左侧的锁图标 → 证书 → 详细信息 → 复制到文件，选择PEM格式导出Zscaler根证书。
2. 找到Python安装目录下的lib\site-packages\certifi\cacert.pem文件（比如C:\Users\201046329\AppData\Local\Programs\Python\Python310\lib\site-packages\certifi\cacert.pem）。
3. 用文本编辑器打开导出的Zscaler证书和cacert.pem，将Zscaler证书的内容追加到cacert.pem文件末尾，保存即可。

内容的提问来源于stack exchange，提问作者Corentin Gauquier