CODEWITHSUNDEEP
pythonpython-3.xsslpython-requests
visy
visy

Reputation: 21

python requests raised SSLError, how to fix that?

import requests
s = requests.session()
print(s.get('https://imagetwist.com/')) # print(s.get('https://img119.imagetwist.com/'))

Error: 

requests.exceptions.SSLError: HTTPSConnectionPool(host='imagetwist.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')],)",),))

If I request a subdomain(https://img119.imagetwist.com/), it works fine.

Could someone help me, tks!

Python 3.6.9, ubuntu 18.04.1

Upvotes: 2

Views: 1446

Answers (2)

αԋɱҽԃ αмєяιcαη
αԋɱҽԃ αмєяιcαη

Reputation: 11505

The error is explaining that is unable to verify the SSL certification by the HOST.

so you've to use verify=False for that case.

Check SSL CERT Verification

And Here Disable SSL Warnings

import requests
import urllib3


urllib3.disable_warnings()

with requests.Session() as req:
    r = req.get("https://imagetwist.com/", verify=False)
    print(r)

Upvotes: 1

Alastair McCormack
Alastair McCormack

Reputation: 27704

Update

I took the liberty to contact imagetwist.com and let them know of the problem. Within the hour they had fixed the issue with a complete certificate chain. Kudos to Imagetwist!

--

Redundant debug information for similar issues:

The server configuration of imagetwist.com is incorrect - it's not providing the full certificate chain back to a shared trusted CA. While Chrome (and others) will fill in the gaps, Python's library is unable to do so.

Compare the results from:

openssl s_client -connect img119.imagetwist.com:443 -showcerts
openssl s_client -connect imagetwist.com:443 -showcerts

Usually, the server will provide a list of certificates which will "synchronise" to a Certificate Authority certificate in your ca_bundle (A file/directory containing CAs recognised by you and your computer).

There are three options:

  1. Ask imagetwist.com to fix their configuration (Good luck!)
  2. Add their certificate to your ca_bundle (You'll have to renew everytime they update the cert)
  3. Add the intermediates certs to your ca_bundle.

Option 3 is probably the best long term solution until imagetwist fix their setup.

Depending on your Python installation, you'll need to add the following to your ca_bundle, which will fill in missing cert chain on your machine:

----BEGIN CERTIFICATE-----
MIIGEzCCA/ugAwIBAgIQfVtRJrR2uhHbdBYLvFMNpzANBgkqhkiG9w0BAQwFADCB
iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl
cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV
BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTgx
MTAyMDAwMDAwWhcNMzAxMjMxMjM1OTU5WjCBjzELMAkGA1UEBhMCR0IxGzAZBgNV
BAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEYMBYGA1UE
ChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFJTQSBEb21haW4g
VmFsaWRhdGlvbiBTZWN1cmUgU2VydmVyIENBMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEA1nMz1tc8INAA0hdFuNY+B6I/x0HuMjDJsGz99J/LEpgPLT+N
TQEMgg8Xf2Iu6bhIefsWg06t1zIlk7cHv7lQP6lMw0Aq6Tn/2YHKHxYyQdqAJrkj
eocgHuP/IJo8lURvh3UGkEC0MpMWCRAIIz7S3YcPb11RFGoKacVPAXJpz9OTTG0E
oKMbgn6xmrntxZ7FN3ifmgg0+1YuWMQJDgZkW7w33PGfKGioVrCSo1yfu4iYCBsk
Haswha6vsC6eep3BwEIc4gLw6uBK0u+QDrTBQBbwb4VCSmT3pDCg/r8uoydajotY
uK3DGReEY+1vVv2Dy2A0xHS+5p3b4eTlygxfFQIDAQABo4IBbjCCAWowHwYDVR0j
BBgwFoAUU3m/WqorSs9UgOHYm8Cd8rIDZsswHQYDVR0OBBYEFI2MXsRUrYrhd+mb
+ZsF4bgBjWHhMA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8ECDAGAQH/AgEAMB0G
A1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAbBgNVHSAEFDASMAYGBFUdIAAw
CAYGZ4EMAQIBMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0
LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDB2Bggr
BgEFBQcBAQRqMGgwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRydXN0LmNv
bS9VU0VSVHJ1c3RSU0FBZGRUcnVzdENBLmNydDAlBggrBgEFBQcwAYYZaHR0cDov
L29jc3AudXNlcnRydXN0LmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAMr9hvQ5Iw0/H
ukdN+Jx4GQHcEx2Ab/zDcLRSmjEzmldS+zGea6TvVKqJjUAXaPgREHzSyrHxVYbH
7rM2kYb2OVG/Rr8PoLq0935JxCo2F57kaDl6r5ROVm+yezu/Coa9zcV3HAO4OLGi
H19+24rcRki2aArPsrW04jTkZ6k4Zgle0rj8nSg6F0AnwnJOKf0hPHzPE/uWLMUx
RP0T7dWbqWlod3zu4f+k+TY4CFM5ooQ0nBnzvg6s1SQ36yOoeNDT5++SR2RiOSLv
xvcRviKFxmZEJCaOEDKNyJOuB56DPi/Z+fVGjmO+wea03KbNIaiGCpXZLoUmGv38
sbZXQm2V0TP2ORQGgkE49Y9Y3IBbpNV9lXj9p5v//cWoaasm56ekBYdbqbe4oyAL
l6lFhd2zi+WJN44pDfwGF/Y4QA5C5BIG+3vzxhFoYt/jmPQT2BVPi7Fp2RBgvGQq
6jG35LWjOhSbJuMLe/0CjraZwTiXWTb2qHSihrZe68Zk6s+go/lunrotEbaGmAhY
LcmsJWTyXnW0OMGuf1pGg+pRyrbxmRE1a6Vqe8YAsOf4vmSyrcjC8azjUeqkk+B5
yOGBQMkKW+ESPMFgKuOXwIlCypTPRpgSabuY0MLTDXJLR27lk8QyKGOHQ+SwMj4K
00u/I5sUKUErmgQfky3xxzlIPK1aEn8=
-----END CERTIFICATE-----

This intermediate certificate comes from the their correctly configured server (img119.imagetwist.com) instance.

I have then verified it using two methods:

  1. Apple's Keychain: openssl verify sectigo.crt
  2. Using Mozilla's converted cert chain: curl https://curl.haxx.se/ca/cacert.pem | openssl verify -CAfile /dev/stdin sectigo.crt

Both result in:

sectigo.crt: OK
Chain:
depth=0: C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA (untrusted)
depth=1: C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority

Therefore, the missing intermediate (Sectigo) certificate is validated by "The USERTRUST Network" CA present in the Apple default Keychain and Mozilla's CA Bundle.

Upvotes: 3

Related Questions