# aiohttp.client_exceptions.ClientConnectorCertificateError: Cannot connect to host example.com:443 ssl:True [SSLCertVerificationError: certificate verify failed: unable to get local issuer certificate]

- **ID:** `python/aiohttp-clientconnector-ssl-certificate-verify-failed`
- **Domain:** python
- **Category:** network_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

The system CA bundle is missing or outdated, so aiohttp's default SSL context cannot verify the server's certificate chain.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 3.8+ | active | — | — |

## Workarounds

1. **** (92% success)
   ```
   import ssl, certifi, aiohttp
ctx = ssl.create_default_context(cafile=certifi.where())
async with aiohttp.ClientSession(connector=aiohttp.TCPConnector(ssl=ctx)) as s:
    await s.get('https://example.com')
   ```
2. **** (85% success)
   ```
   sudo apt-get install --reinstall ca-certificates && sudo update-ca-certificates
   ```

## Dead Ends

- **** — Disables all TLS verification, exposes to MITM and is rejected by many servers; masks the real CA problem. (60% fail)
- **** — aiohttp uses its own default context, which on some platforms ignores certifi unless explicitly passed via ssl context. (55% fail)