3

I tried to do the first command in the Quickstart for requests:

>>> import requests
>>> r = requests.get('https://github.com/timeline.json')

But I get the following error message:

Traceback (most recent call last):
  File "./main.py", line 16, in <module>
    requests.get('https://github.com/timeline.json')
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/requests/api.py", line 55, in get
    return request('get', url, **kwargs)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/requests/api.py", line 44, in request
    return session.request(method=method, url=url, **kwargs)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/requests/sessions.py", line 383, in request
    resp = self.send(prep, **send_kwargs)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/requests/sessions.py", line 486, in send
    r = adapter.send(request, **kwargs)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/requests/adapters.py", line 385, in send
    raise SSLError(e)
requests.exceptions.SSLError: [Errno 1] _ssl.c:499: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

I am totally new to SSL certificates, but I suspect it has something to do with Python looking in the wrong place. I downloaded Python 2.7 and am using it as my default Python (I am running Mac OSX 10.6 (Snow Leopard), which came with Python 2.6). I had a lot of trouble with my Mac looking in the wrong place for Python stuff until I fixed the paths and made symbolic links, but I wonder if there is something else that has to do with the upgrade that is causing this SSL error? Or it could be something that doesn't have anything to do with that.

I have tried searching for similar questions and read some people's suggestions just to add the argument verify=False in requests.get(), but I don't want to do that, since I think that just avoids the real problem. Thanks for helping out a complete newbie.

Community
  • 1
  • 1
newt
  • 199
  • 2
  • 12
  • Please check if you have a fle /Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/requests/cacert.pem . This is the CA file it should be using for verification. – Steffen Ullrich Mar 15 '14 at 20:17
  • @SteffenUllrich, yes it is there. – newt Mar 16 '14 at 17:56
  • 1
    Then you might check (with dtruss?) if it gets used or if it is looking elsewhere for a cacert.pem file. If it gets used make sure that "DigiCert High Assurance EV Root CA" (sha-1 5f:b7:ee:06:33:e2:59:db:ad:0c:4c:9a:e6:d3:8f:1a:61:c7:dc:25) is in the file, because this the CA which signed the github.com certificate. And of course, all of this is useless if you are behind a firewall which does SSL interception, because then you don't get the original certificates. – Steffen Ullrich Mar 16 '14 at 18:31
  • @SteffenUllrich Same problem here. I got rid of an antivirus just in case it was blocking anything. Weird thing is that when I do a "openssl s_client -connect some-domain.com:443 -CAfile cert.pem" it works ok. Also, I followed your advice and tried this on the commandline. "dtruss -a python -c "import requests; requests.get('https://some-domain-with-ssl.com');"". Got this as result http://pastebin.com/8ac3nawu – Patrick Bassut Jul 12 '14 at 06:22
  • This is not much in you druss output, there aren't any syscalls from inside python. I don't know the right tool for syscall tracing on Mac OSX, but in BSD this is ktrace and with Linux strace. Maybe you have some additional options if you want to get the syscalls from a python script. As for openssl: does it work against the cacert.pem from the requests library, i.e. does it not only connect, but also explicitly gives `Verify return code: 0 (ok)`? – Steffen Ullrich Jul 12 '14 at 13:30
  • @newt please review my answer here: http://stackoverflow.com/questions/30830901/python-requests-throwing-ssl-errors/30831120#30831120. does it resolve your issue? – boaz_shuster Jun 14 '15 at 15:47

1 Answers1

0

You can try this.

Verify the path to the cert:

>>> requests.get('https://whatever.com', verify='/path/to/certfile')

Or

>>> requests.get('https://whatever.com', cert=('/path/server.crt', '/path/key'))

http://docs.python-requests.org/en/latest/user/advanced/

daguy666
  • 55
  • 7