# aiohttp.client_exceptions.ClientConnectorCertificateError: Cannot connect to host example.com:443 ssl:True [SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate')]

- **ID:** `python/aiohttp-client-connector-ssl-certificate-error`
- **Domain:** python
- **Category:** network_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

The TLS handshake failed because the client's trust store does not contain the CA that signed the server certificate. Common on macOS with python.org installers or in containers missing ca-certificates.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 3.8 | active | — | — |
| 3.9 | active | — | — |
| 3.10 | active | — | — |
| 3.11 | active | — | — |
| 3.12 | active | — | — |

## Workarounds

1. **** (92% success)
   ```
   # macOS python.org
'/Applications/Python 3.x/Install Certificates.command'
# Debian/Ubuntu
apt-get install -y ca-certificates && update-ca-certificates
# pip
pip install --upgrade certifi
   ```
2. **** (88% success)
   ```
   import ssl, certifi
ctx = ssl.create_default_context(cafile=certifi.where())
conn = aiohttp.TCPConnector(ssl=ctx)
async with aiohttp.ClientSession(connector=conn) as s:
    ...
   ```
3. **** (85% success)
   ```
   import ssl, truststore
truststore.inject_into_ssl()
# then aiohttp uses the OS trust store automatically
   ```

## Dead Ends

- **** — Disables verification and exposes the app to MITM; also not accepted by all aiohttp versions in the same way. (40% fail)
- **** — Affects urllib, not aiohttp/ssl; the SSL context still verifies. (85% fail)
- **** — Same security problem as ssl=False, and does not fix the trust-store gap for other hosts. (50% fail)