Python调用Twilio号码查询API遭遇requests.exceptions.SSLError求助

我正在使用Python版Twilio电话号码查询API（client.lookups.v2.phone_numbers）在本地验证电话号码，代码如下：

from twilio.rest import Client

account_sid = "••••••••••••••••••••••••••"
auth_token = "••••••••••••••••••••••••••"

client = Client(account_sid, auth_token)

phone_number = client.lookups.v2.phone_numbers("+14159929960").fetch()
print(phone_number)

排查过程 #

• 按照Twilio官方的证书错误排查指引，下载并安装了curl官网提供的最新Mozilla PEM格式CA证书包（包含所需的DigiCert Global Root CA），也单独下载安装了DigiCert的CRT格式证书，但错误依然存在。
• 确定错误触发点在python3.9/site-packages/OpenSSL/SSL.py中的result = _lib.SSL_do_handshake(self._ssl)代码行，但搜索数小时仍找不到SSL_do_handshake的定义，无法进一步定位问题。
• 尝试过Stack Overflow上的方案，在MacBook上无法将证书导入钥匙串，未生效。
• 想尝试关闭证书验证（ssl.CERT_NONE），但不知道该配置放在哪里，推测Twilio SDK底层使用urllib3，但找不到对应的配置位置。
• 网上多数解决方案针对requests库的问题，对当前场景帮助不大。

关键测试结果 #

用以下bash脚本测试Twilio Lookup API，可以正常返回结果，说明问题出在Python环境而非证书本身：

curl -X GET 'https://lookups.twilio.com/v2/PhoneNumbers/+14159929960' \
-u $TWILIO_ACCOUNT_SID:$TWILIO_AUTH_TOKEN

完整错误栈 #

Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/urllib3/contrib/pyopenssl.py", line 437, in wrap_socket
    cnx.do_handshake()
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/OpenSSL/SSL.py", line 1835, in do_handshake
    self._raise_ssl_error(self._ssl, result)
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/OpenSSL/SSL.py", line 1570, in _raise_ssl_error
    _raise_current_error()
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/OpenSSL/_util.py", line 51, in exception_from_error_queue
    raise exception_type(errors)
OpenSSL.SSL.Error: [('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')]

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/urllib3/connectionpool.py", line 597, in urlopen
    httplib_response = self._make_request(conn, method, url,
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/urllib3/connectionpool.py", line 343, in _make_request
    self._validate_conn(conn)
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/urllib3/connectionpool.py", line 839, in _validate_conn
    conn.connect()
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/urllib3/connection.py", line 337, in connect
    self.sock = ssl_wrap_socket(
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/urllib3/util/ssl_.py", line 345, in ssl_wrap_socket
    return context.wrap_socket(sock, server_hostname=server_hostname)
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/urllib3/contrib/pyopenssl.py", line 443, in wrap_socket
    raise ssl.SSLError("bad handshake: %r" % e)
ssl.SSLError: ("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])",)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/requests/adapters.py", line 439, in send
    resp = conn.urlopen(
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/urllib3/connectionpool.py", line 637, in urlopen
    retries = retries.increment(method, url, error=e, _pool=self,
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/urllib3/util/retry.py", line 399, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='lookups.twilio.com', port=443): Max retries exceeded with url: /v2/PhoneNumbers/+14159929960 (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])")))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/path/to/twiliophonelookup.py", line 16, in <module>
    phone_number = client.lookups.v2.phone_numbers("+14159929960").fetch()
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/twilio/rest/lookups/v2/phone_number.py", line 153, in fetch
    payload = self._version.fetch(
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/twilio/base/version.py", line 72, in fetch
    response = self.request(
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/twilio/base/version.py", line 39, in request
    return self.domain.request(
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/twilio/base/domain.py", line 38, in request
    return self.twilio.request(
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/twilio/rest/__init__.py", line 142, in request
    return self.http_client.request(
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/twilio/http/http_client.py", line 89, in request
    response = session.send(prepped_request, **settings)
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/requests/sessions.py", line 646, in send
    r = adapter.send(request, **kwargs)
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/requests/adapters.py", line 514, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='lookups.twilio.com', port=443): Max retries exceeded with url: /v2/PhoneNumbers/+14159929960 (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])")))

内容的提问来源于stack exchange，提问作者WushuDrew