python network_error ai_generated true

aiohttp.client_exceptions.ClientConnectorCertificateError: Cannot connect to host example.com:443 ssl:True [SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate')]

ID: python/aiohttp-client-connector-ssl-certificate-error

Also available as: JSON · Markdown · 中文
80%Fix Rate
87%Confidence
0Evidence
2024-07-19First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
3.8 active — — —
3.9 active — — —
3.10 active — — —
3.11 active — — —
3.12 active — — —

Root Cause

The TLS handshake failed because the client's trust store does not contain the CA that signed the server certificate. Common on macOS with python.org installers or in containers missing ca-certificates.

generic

中文

TLS 握手失败，因为客户端信任库中没有签发服务器证书的 CA。常见于使用 python.org 安装包的 macOS，或缺少 ca-certificates 的容器。

Workarounds

  1. 92% success 
    # macOS python.org
'/Applications/Python 3.x/Install Certificates.command'
# Debian/Ubuntu
apt-get install -y ca-certificates && update-ca-certificates
# pip
pip install --upgrade certifi
  2. 88% success 
    import ssl, certifi
ctx = ssl.create_default_context(cafile=certifi.where())
conn = aiohttp.TCPConnector(ssl=ctx)
async with aiohttp.ClientSession(connector=conn) as s:
    ...
  3. 85% success 
    import ssl, truststore
truststore.inject_into_ssl()
# then aiohttp uses the OS trust store automatically

Dead Ends

Common approaches that don't work:

  1. 40% fail

    Disables verification and exposes the app to MITM; also not accepted by all aiohttp versions in the same way.

  2. 85% fail

    Affects urllib, not aiohttp/ssl; the SSL context still verifies.

  3. 50% fail

    Same security problem as ssl=False, and does not fix the trust-store gap for other hosts.