使用requests.get请求网站遭遇ssl.SSLCertVerificationError问题咨询

问题描述 #

使用Python的requests库向https://barefootleather.co.uk/发送GET请求时，触发ssl.SSLCertVerificationError错误，核心报错为certificate verify failed: unable to get local issuer certificate。

代码示例 #

import requests
import fake_useragent

user = fake_useragent.UserAgent().random
header = {'user-agent': user}

html_URL = requests.get("https://barefootleather.co.uk/", headers=header, timeout=10)

print(html_URL.status_code)

报错信息 #

Traceback (most recent call last):
  File "/home/kali/Desktop/python/CMS_type_shop/venv/lib/python3.9/site-packages/urllib3/connectionpool.py", line 703, in urlopen
    httplib_response = self._make_request(
  File "/home/kali/Desktop/python/CMS_type_shop/venv/lib/python3.9/site-packages/urllib3/connectionpool.py", line 386, in _make_request
    self._validate_conn(conn)
  File "/home/kali/Desktop/python/CMS_type_shop/venv/lib/python3.9/site-packages/urllib3/connectionpool.py", line 1042, in _validate_conn
    conn.connect()
  File "/home/kali/Desktop/python/CMS_type_shop/venv/lib/python3.9/site-packages/urllib3/connection.py", line 414, in connect
    self.sock = ssl_wrap_socket(
  File "/home/kali/Desktop/python/CMS_type_shop/venv/lib/python3.9/site-packages/urllib3/util/ssl_.py", line 449, in ssl_wrap_socket
    ssl_sock = _ssl_wrap_socket_impl(
  File "/home/kali/Desktop/python/CMS_type_shop/venv/lib/python3.9/site-packages/urllib3/util/ssl_.py", line 493, in _ssl_wrap_socket_impl
    return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
  File "/usr/lib/python3.9/ssl.py", line 501, in wrap_socket
    return self.sslsocket_class._create(
  File "/usr/lib/python3.9/ssl.py", line 1041, in _create
    self.do_handshake()
  File "/usr/lib/python3.9/ssl.py", line 1310, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/kali/Desktop/python/CMS_type_shop/venv/lib/python3.9/site-packages/requests/adapters.py", line 489, in send
    resp = conn.urlopen(
  File "/home/kali/Desktop/python/CMS_type_shop/venv/lib/python3.9/site-packages/urllib3/connectionpool.py", line 787, in urlopen
    retries = retries.increment(
  File "/home/kali/Desktop/python/CMS_type_shop/venv/lib/python3.9/site-packages/urllib3/util/retry.py", line 592, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='barefootleather.co.uk', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/kali/Desktop/python/CMS_type_shop/test.py", line 7, in <module>
    html_URL = requests.get("https://barefootleather.co.uk/", headers=header, timeout=10)
  File "/home/kali/Desktop/python/CMS_type_shop/venv/lib/python3.9/site-packages/requests/api.py", line 73, in get
    return request("get", url, params=params, **kwargs)
  File "/home/kali/Desktop/python/CMS_type_shop/venv/lib/python3.9/site-packages/requests/api.py", line 59, in request
    return session.request(method=method, url=url, **kwargs)
  File "/home/kali/Desktop/python/CMS_type_shop/venv/lib/python3.9/site-packages/requests/sessions.py", line 587, in request
    resp = self.send(prep, **send_kwargs)
  File "/home/kali/Desktop/python/CMS_type_shop/venv/lib/python3.9/site-packages/requests/sessions.py", line 701, in send
    r = adapter.send(request, **kwargs)
  File "/home/kali/Desktop/python/CMS_type_shop/venv/lib/python3.9/site-packages/requests/adapters.py", line 563, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='barefootleather.co.uk', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)')))

问题原因 #

这个错误是SSL证书验证环节失败导致的，具体原因分三类：

• 本地CA证书缺失：requests依赖系统或指定的CA证书来验证服务器SSL证书合法性，如果本地没有安装对应服务器证书的签发机构（CA）证书，就无法完成验证。
• 虚拟环境证书配置异常：你使用的venv虚拟环境可能未正确继承系统CA证书路径，导致requests找不到验证所需的证书文件。
• 服务器证书链不完整：目标服务器的SSL证书链存在缺失，客户端无法追溯到受信任的根CA证书。

解决方法 #

方法1：临时跳过证书验证（仅测试用） #

在requests.get中添加verify=False参数，直接关闭SSL验证：

html_URL = requests.get("https://barefootleather.co.uk/", headers=header, timeout=10, verify=False)

⚠️ 注意：这种方式会放弃SSL安全验证，存在中间人攻击风险，只适合本地测试场景，严禁在生产环境使用。

方法2：指定CA证书文件路径 #

从浏览器导出目标服务器的CA证书文件后，通过verify参数指定证书路径：

html_URL = requests.get("https://barefootleather.co.uk/", headers=header, timeout=10, verify="/path/to/your/ca-cert.pem")

方法3：修复系统/虚拟环境的CA证书配置 #

1. 更新系统CA证书：在Kali系统中执行以下命令，重新安装并更新根CA证书：

sudo apt update && sudo apt install --reinstall ca-certificates

2. 重置虚拟环境：如果虚拟环境仍无法读取系统证书，可删除现有虚拟环境后重新创建，确保新环境继承系统证书配置。

内容的提问来源于stack exchange，提问作者Valera