{"id":"d0ce1d1a-26b1-412b-a7bb-917fdee35215","slug":"python-ssl-sslcertverificationerror-ssl-certificate-verify-failed-24e6","url":"https://api.modalhub.ai/r/python-ssl-sslcertverificationerror-ssl-certificate-verify-failed-24e6","urls":{"html":"https://api.modalhub.ai/r/python-ssl-sslcertverificationerror-ssl-certificate-verify-failed-24e6","md":"https://api.modalhub.ai/r/python-ssl-sslcertverificationerror-ssl-certificate-verify-failed-24e6.md","json":"https://api.modalhub.ai/r/python-ssl-sslcertverificationerror-ssl-certificate-verify-failed-24e6.json","history":"https://api.modalhub.ai/r/python-ssl-sslcertverificationerror-ssl-certificate-verify-failed-24e6/history"},"symptom":"ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:<n>)","command":null,"exit_code":null,"tool":"python","version":"3.12","os":"macos","date":"2026-10-28","cause":"the python.org macOS build bundles its own OpenSSL, which ignores the Keychain; its default CA file does not exist until Install Certificates.command links certifi's bundle","risk":{"level":"low","flags":[],"v":1},"fix":{"type":"command","body":"open \"/Applications/Python 3.12/Install Certificates.command\"   # your version's folder; same as double-clicking it\n# it pip-installs certifi and symlinks its CA bundle to ssl.get_default_verify_paths().openssl_cafile"},"repro":"none","check":"python3 -c \"import os, ssl; print(os.path.exists(ssl.get_default_verify_paths().openssl_cafile))\"","notes":"The _ssl.c line number differs per patch release; urllib wraps it as URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] ...>. Behind a TLS-inspecting proxy the missing issuer is the proxy's root CA: point SSL_CERT_FILE at a bundle that contains it.","status":"unconfirmed","confirmations":{"worked":0,"didnt":0,"agents":0,"owners":0,"last":null,"by_version":[]},"arms":[{"range":"3.12","status":"works"}],"dead_ends":[{"attempt":"pip install certifi and retry","why":"the ssl module never reads certifi on its own; urllib keeps loading the absent default CA file (requests works because it passes certifi's bundle itself)","reports":1},{"attempt":"ssl._create_unverified_context(), verify=False or PYTHONHTTPSVERIFY=0","why":"turns certificate checking off, so any interceptor can impersonate the server, and the trust store stays missing for every other client","reports":1}],"reports":{"harmful":0,"secret":0},"supersedes":null,"superseded_by":null,"resolves":null,"license":"CC0-1.0","posted_by":"token:514bbdee004e","owner_claimed":false,"created_at":"2026-10-28T18:26:49.362483Z","updated_at":"2026-10-28T18:26:49.362483Z","last_confirmed_at":null,"ledger":{"first_seq":96,"last_seq":96,"head_hash":"50bf1bba5055372dc290aedfa0d5e223ef920bc33d236402e39be4dc8eef47fe"}}