# aiohttp.client_exceptions.ClientConnectorCertificateError: 无法连接到主机 example.com:443 ssl:True [SSLCertVerificationError: 证书验证失败：无法获取本地颁发者证书]

- **ID:** `python/aiohttp-clientconnector-ssl-certificate-verify-failed`
- **领域:** python
- **类别:** network_error
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

系统 CA 证书包缺失或过时，导致 aiohttp 默认的 SSL 上下文无法验证服务器证书链。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| 3.8+ | active | — | — |

## 解决方案

1. **** (92% 成功率)
   ```
   import ssl, certifi, aiohttp
ctx = ssl.create_default_context(cafile=certifi.where())
async with aiohttp.ClientSession(connector=aiohttp.TCPConnector(ssl=ctx)) as s:
    await s.get('https://example.com')
   ```
2. **** (85% 成功率)
   ```
   sudo apt-get install --reinstall ca-certificates && sudo update-ca-certificates
   ```

## 无效尝试

- **** — Disables all TLS verification, exposes to MITM and is rejected by many servers; masks the real CA problem. (60% 失败率)
- **** — aiohttp uses its own default context, which on some platforms ignores certifi unless explicitly passed via ssl context. (55% 失败率)