python network_error ai_generated true

aiohttp.client_exceptions.ClientConnectorCertificateError: Cannot connect to host example.com:443 ssl:True [SSLCertVerificationError: certificate verify failed: unable to get local issuer certificate]

ID: python/aiohttp-clientconnector-ssl-certificate-verify-failed

Also available as: JSON · Markdown · 中文
80%Fix Rate
87%Confidence
0Evidence
2024-05-02First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
3.8+ active — — —

Root Cause

The system CA bundle is missing or outdated, so aiohttp's default SSL context cannot verify the server's certificate chain.

generic

中文

系统 CA 证书包缺失或过时，导致 aiohttp 默认的 SSL 上下文无法验证服务器证书链。

Workarounds

  1. 92% success 
    import ssl, certifi, aiohttp
ctx = ssl.create_default_context(cafile=certifi.where())
async with aiohttp.ClientSession(connector=aiohttp.TCPConnector(ssl=ctx)) as s:
    await s.get('https://example.com')
  2. 85% success 
    sudo apt-get install --reinstall ca-certificates && sudo update-ca-certificates

Dead Ends

Common approaches that don't work:

  1. 60% fail

    Disables all TLS verification, exposes to MITM and is rejected by many servers; masks the real CA problem.

  2. 55% fail

    aiohttp uses its own default context, which on some platforms ignores certifi unless explicitly passed via ssl context.