Twilio - Phone Lookup requests.exceptions.SSLError

Question

I'm using Twilio's phone number lookup API (client.lookups.v2.phone_numbers) for Python. I will only be using this on my local machine to validate phone numbers.

Here's my code:

from twilio.rest import Client

account_sid = "••••••••••••••••••••••••••"
auth_token = "••••••••••••••••••••••••••"

client = Client(account_sid, auth_token)

phone_number = client.lookups.v2.phone_numbers("+14159929960").fetch()
print(phone_number)

I put the full error stack at the bottom because it's a huge wall of text.

In the Troubleshooting Certificate Errors from the Twilio REST API page, they suggest that I:

download the latest Mozilla-provided CA certificate bundle in PEM format from curl's website, which already includes our new root certificate. The specific certificate required from the bundle is DigiCert Global Root CA, which is directly available for download in CRT format from DigiCert.

so I downloaded and installed the CA certificate bundle as well as the DigiCert Global Root CA, but it threw the same errors.

I'm pretty sure that the problem exists in python3.9/site-packages/OpenSSL/SSL.py with result = _lib.SSL_do_handshake(self._ssl). I looked around for a few hours and I could not find the SSL_do_handshake def to see where the holdup is.

• This answer didn't work on my macbook, I just couldn't import the files into my keychain.
• I would like to try this solution, but I don't know where I would put ssl.CERT_NONE. I believe Twilio uses urllib3, but I can't find a place to put it.
• This answer involves using requests, which I am not using.
• Most answers are addressing issues with ```requests``, so there isn't much that helps there.
• Looking at this question inspired me to try this bash script:

curl -X GET 'https://lookups.twilio.com/v2/PhoneNumbers/+14159929960' \
-u $TWILIO_ACCOUNT_SID:$TWILIO_AUTH_TOKEN

And it worked! So this seems to be a Python issue and not a certificate issue.

Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/urllib3/contrib/pyopenssl.py", line 437, in wrap_socket
    cnx.do_handshake()
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/OpenSSL/SSL.py", line 1835, in do_handshake
    self._raise_ssl_error(self._ssl, result)
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/OpenSSL/SSL.py", line 1570, in _raise_ssl_error
    _raise_current_error()
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/OpenSSL/_util.py", line 51, in exception_from_error_queue
    raise exception_type(errors)
OpenSSL.SSL.Error: [('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')]

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/urllib3/connectionpool.py", line 597, in urlopen
    httplib_response = self._make_request(conn, method, url,
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/urllib3/connectionpool.py", line 343, in _make_request
    self._validate_conn(conn)
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/urllib3/connectionpool.py", line 839, in _validate_conn
    conn.connect()
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/urllib3/connection.py", line 337, in connect
    self.sock = ssl_wrap_socket(
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/urllib3/util/ssl_.py", line 345, in ssl_wrap_socket
    return context.wrap_socket(sock, server_hostname=server_hostname)
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/urllib3/contrib/pyopenssl.py", line 443, in wrap_socket
    raise ssl.SSLError("bad handshake: %r" % e)
ssl.SSLError: ("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])",)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/requests/adapters.py", line 439, in send
    resp = conn.urlopen(
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/urllib3/connectionpool.py", line 637, in urlopen
    retries = retries.increment(method, url, error=e, _pool=self,
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/urllib3/util/retry.py", line 399, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='lookups.twilio.com', port=443): Max retries exceeded with url: /v2/PhoneNumbers/+14159929960 (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])")))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/path/to/twiliophonelookup.py", line 16, in <module>
    phone_number = client.lookups.v2.phone_numbers("+14159929960").fetch()
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/twilio/rest/lookups/v2/phone_number.py", line 153, in fetch
    payload = self._version.fetch(
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/twilio/base/version.py", line 72, in fetch
    response = self.request(
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/twilio/base/version.py", line 39, in request
    return self.domain.request(
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/twilio/base/domain.py", line 38, in request
    return self.twilio.request(
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/twilio/rest/__init__.py", line 142, in request
    return self.http_client.request(
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/twilio/http/http_client.py", line 89, in request
    response = session.send(prepped_request, **settings)
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/requests/sessions.py", line 646, in send
    r = adapter.send(request, **kwargs)
  File "/Library/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/requests/adapters.py", line 514, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='lookups.twilio.com', port=443): Max retries exceeded with url: /v2/PhoneNumbers/+14159929960 (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])")))

Answer 1

Thanks to philnash and this answer, the solution is this:

export REQUESTS_CA_BUNDLE=<path to pem>

I tried a couple, but the one that worked was:

export REQUESTS_CA_BUNDLE=/usr/local/etc/openssl/cacert.cer