通过pyngrok安装ngrok时出现SSL证书验证失败报错求助

从Twilio官方文档摘取的自动化建立ngrok连接的代码如下：

from pyngrok import ngrok
public_url = ngrok.connect(5000).public_url

本地运行时在ngrok自动下载阶段触发SSL证书校验失败异常，完整报错日志如下：

Downloading ngrok ...
Traceback (most recent call last):
  File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.9_3.9.2032.0_x64__qbz5n2kfra8p0\lib\urllib\request.py", line 1346, in do_open
    h.request(req.get_method(), req.selector, req.data, headers,
  File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.9_3.9.2032.0_x64__qbz5n2kfra8p0\lib\http\client.py", line 1279, in request
    self._send_request(method, url, body, headers, encode_chunked)
  File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.9_3.9.2032.0_x64__qbz5n2kfra8p0\lib\http\client.py", line 1325, in _send_request
    self.endheaders(body, encode_chunked=encode_chunked)
  File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.9_3.9.2032.0_x64__qbz5n2kfra8p0\lib\http\client.py", line 1274, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.9_3.9.2032.0_x64__qbz5n2kfra8p0\lib\http\client.py", line 1034, in _send_output
    self.send(msg)
  File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.9_3.9.2032.0_x64__qbz5n2kfra8p0\lib\http\client.py", line 974, in send
    self.connect()
  File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.9_3.9.2032.0_x64__qbz5n2kfra8p0\lib\http\client.py", line 1448, in connect
    self.sock = self._context.wrap_socket(self.sock,
  File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.9_3.9.2032.0_x64__qbz5n2kfra8p0\lib\ssl.py", line 500, in wrap_socket
    return self.sslsocket_class._create(
  File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.9_3.9.2032.0_x64__qbz5n2kfra8p0\lib\ssl.py", line 1040, in _create
    self.do_handshake()
  File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.9_3.9.2032.0_x64__qbz5n2kfra8p0\lib\ssl.py", line 1309, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\Users\Vic\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\pyngrok\installer.py", line 94, in install_ngrok
    download_path = _download_file(url, **kwargs)
  File "C:\Users\Vic\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\pyngrok\installer.py", line 215, in _download_file
    response = urlopen(url, **kwargs)
  File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.9_3.9.2032.0_x64__qbz5n2kfra8p0\lib\urllib\request.py", line 214, in urlopen
    return opener.open(url, data, timeout)
  File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.9_3.9.2032.0_x64__qbz5n2kfra8p0\lib\urllib\request.py", line 517, in open
    response = self._open(req, data)
  File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.9_3.9.2032.0_x64__qbz5n2kfra8p0\lib\urllib\request.py", line 534, in _open
    result = self._call_chain(self.handle_open, protocol, protocol +
  File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.9_3.9.2032.0_x64__qbz5n2kfra8p0\lib\urllib\request.py", line 494, in _call_chain
    result = func(*args)
  File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.9_3.9.2032.0_x64__qbz5n2kfra8p0\lib\urllib\request.py", line 1389, in https_open
    return self.do_open(http.client.HTTPSConnection, req,
  File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.9_3.9.2032.0_x64__qbz5n2kfra8p0\lib\urllib\request.py", line 1349, in do_open
    raise URLError(err)
urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)>

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "d:\Files\School\Linkdemic\Linkdemic\try.py", line 3, in <module>
    phttp_tunnel = ngrok.connect()
  File "C:\Users\Vic\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\pyngrok\ngrok.py", line 251, in connect
    api_url = get_ngrok_process(pyngrok_config).api_url
  File "C:\Users\Vic\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\pyngrok\ngrok.py", line 160, in get_ngrok_process
    install_ngrok(pyngrok_config)
  File "C:\Users\Vic\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\pyngrok\ngrok.py", line 98, in install_ngrok
    installer.install_ngrok(pyngrok_config.ngrok_path)
  File "C:\Users\Vic\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\pyngrok\installer.py", line 98, in install_ngrok
    raise PyngrokNgrokInstallError("An error occurred while downloading ngrok from {}: {}".format(url, e))
pyngrok.exception.PyngrokNgrokInstallError: An error occurred while downloading ngrok from https://bin.equinox.io/c/4VmDzA7iaHb/ngrok-stable-windows-amd64.zip: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1129)>

该代码可在同事设备正常运行，仅本地触发报错。

报错核心是pyngrok自动下载ngrok二进制文件时，本地环境无法校验下载源的SSL证书有效性，服务端证书本身无问题，故障点集中在本地环境：

• Python内置根证书过期/缺失
• 本地网络存在代理、VPN、抓包工具，篡改了SSL证书链
• 公司网络网关做了SSL中间人劫持，自签证书未被Python信任

按优先级选择即可：

• 方案1：手动安装ngrok跳过自动下载
  直接下载报错链接对应的ngrok压缩包，解压后将ngrok.exe放到系统PATH路径下，或者放到pyngrok的默认读取目录，pyngrok检测到已有可执行文件就不会触发自动下载流程，直接运行原代码即可。
• 方案2：临时禁用SSL校验（仅测试用，不建议生产环境使用）
  调整pyngrok配置，跳过下载阶段的SSL校验：

  from pyngrok import ngrok, conf
  import urllib3
  
  # 配置安装阶段跳过SSL校验
  conf.get_default().installer_kwargs = {"verify": False}
  # 禁用不安全请求警告，避免日志冗余
  urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
  
  public_url = ngrok.connect(5000).public_url
  

• 方案3：修复Python根证书
  先升级certifi包更新根证书列表：

  pip install --upgrade certifi
  

  如果是公司网络自签证书的情况，把公司根证书内容追加到certifi包的cacert.pem文件中即可。
• 方案4：排查本地网络配置
  关闭本地运行的抓包工具、VPN，检查系统代理配置，确认下载域名没有被代理劫持后重试。

内容的提问来源于stack exchange，提问作者horald herald