# aiohttp.client_exceptions.ClientConnectorCertificateError: 无法连接到主机 example.com:443 ssl:True [SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] 证书验证失败：无法获取本地颁发者证书')]

- **ID:** `python/aiohttp-client-connector-ssl-certificate-error`
- **领域:** python
- **类别:** network_error
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

TLS 握手失败，因为客户端信任库中没有签发服务器证书的 CA。常见于使用 python.org 安装包的 macOS，或缺少 ca-certificates 的容器。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| 3.8 | active | — | — |
| 3.9 | active | — | — |
| 3.10 | active | — | — |
| 3.11 | active | — | — |
| 3.12 | active | — | — |

## 解决方案

1. **** (92% 成功率)
   ```
   # macOS python.org
'/Applications/Python 3.x/Install Certificates.command'
# Debian/Ubuntu
apt-get install -y ca-certificates && update-ca-certificates
# pip
pip install --upgrade certifi
   ```
2. **** (88% 成功率)
   ```
   import ssl, certifi
ctx = ssl.create_default_context(cafile=certifi.where())
conn = aiohttp.TCPConnector(ssl=ctx)
async with aiohttp.ClientSession(connector=conn) as s:
    ...
   ```
3. **** (85% 成功率)
   ```
   import ssl, truststore
truststore.inject_into_ssl()
# then aiohttp uses the OS trust store automatically
   ```

## 无效尝试

- **** — Disables verification and exposes the app to MITM; also not accepted by all aiohttp versions in the same way. (40% 失败率)
- **** — Affects urllib, not aiohttp/ssl; the SSL context still verifies. (85% 失败率)
- **** — Same security problem as ssl=False, and does not fix the trust-store gap for other hosts. (50% 失败率)