Python "CERTIFICATE_VERIFY_FAILED: unable to get local issuer certificate" in CI
Python's SSL layer could not chain the server certificate to a trusted CA and raised CERTIFICATE_VERIFY_FAILED. requests and urllib3 use the certifi bundle by default, which does not include internal or proxy CAs. The fix is to point Python at a bundle that contains the issuing CA via REQUESTS_CA_BUNDLE or SSL_CERT_FILE, not to pass verify=False.
What this error means
A requests or urllib call fails with "SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:...)".
requests.exceptions.SSLError: HTTPSConnectionPool(host='example.com', port=443):
Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1,
'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local
issuer certificate (_ssl.c:1000)')))Common causes
certifi does not include the internal or proxy CA
requests trusts the certifi bundle, which ships only public roots. A corporate proxy or internal CA is not in it, so verification fails.
An incomplete chain or stale system bundle
The endpoint omits an intermediate, or the runner's system CA store is stale and Python is configured to use it.
How to fix it
Point Python at a bundle with the issuing CA
- Assemble a PEM that contains the certifi roots plus your internal or proxy CA.
- Export REQUESTS_CA_BUNDLE and SSL_CERT_FILE to that file.
- Re-run so requests and the standard library both use it.
export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
python fetch.pyPass the CA bundle to requests directly
For a single client, hand the bundle to verify instead of setting env vars globally.
import requests
requests.get("https://example.com", verify="/etc/ssl/certs/ca-certificates.crt")How to prevent it
- Set REQUESTS_CA_BUNDLE / SSL_CERT_FILE in CI when internal or proxy CAs are used.
- Keep the combined bundle updated with certifi plus your CAs.
- Do not use
verify=False; it disables the check that catches a real MITM.