urllib3 CERTIFICATE_VERIFY_FAILED 在某些具有有效证书的站点上答案

【问题标题】：urllib3 CERTIFICATE_VERIFY_FAILED on some sites with valid certificatesurllib3 CERTIFICATE_VERIFY_FAILED 在某些具有有效证书的站点上
【发布时间】：2017-08-11 13:47:54
【问题描述】：

在某些证书有效的网站上，使用 urllib3 在 python 3.5 中发出 GET 请求失败并出现错误 CERTIFICATE_VERIFY_FAILED。

import certifi
import urllib3
manager = urllib3.PoolManager(cert_reqs='CERT_REQUIRED', ca_certs=certifi.where())
http.request('GET', 'https://google.com')

给出这个错误：

Traceback (most recent call last):
  File "/usr/local/lib/python3.5/site-packages/urllib3/connectionpool.py", line 601, in urlopen
    chunked=chunked)
  File "/usr/local/lib/python3.5/site-packages/urllib3/connectionpool.py", line 346, in _make_request
    self._validate_conn(conn)
  File "/usr/local/lib/python3.5/site-packages/urllib3/connectionpool.py", line 850, in _validate_conn
    conn.connect()
  File "/usr/local/lib/python3.5/site-packages/urllib3/connection.py", line 326, in connect
    ssl_context=context)
  File "/usr/local/lib/python3.5/site-packages/urllib3/util/ssl_.py", line 329, in ssl_wrap_socket
    return context.wrap_socket(sock, server_hostname=server_hostname)
  File "/usr/local/lib/python3.5/ssl.py", line 376, in wrap_socket
    _context=self)
  File "/usr/local/lib/python3.5/ssl.py", line 747, in __init__
    self.do_handshake()
  File "/usr/local/lib/python3.5/ssl.py", line 983, in do_handshake
    self._sslobj.do_handshake()
  File "/usr/local/lib/python3.5/ssl.py", line 628, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:646)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.5/site-packages/requests/adapters.py", line 440, in send
    timeout=timeout
  File "/usr/local/lib/python3.5/site-packages/urllib3/connectionpool.py", line 639, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/local/lib/python3.5/site-packages/urllib3/util/retry.py", line 388, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='google.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:646)'),))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python3.5/site-packages/requests/api.py", line 72, in get
    return request('get', url, params=params, **kwargs)
  File "/usr/local/lib/python3.5/site-packages/requests/api.py", line 58, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/local/lib/python3.5/site-packages/requests/sessions.py", line 508, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/local/lib/python3.5/site-packages/requests/sessions.py", line 618, in send
    r = adapter.send(request, **kwargs)
  File "/usr/local/lib/python3.5/site-packages/requests/adapters.py", line 506, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='google.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:646)'),))

但使用 openssl 命令行发出的相同请求却成功了。

openssl s_client -showcerts -connect google.com:443 -CAfile /usr/local/lib/python3.5/site-packages/certifi/cacert.pem

Urllib3 对某些但不是所有域都失败。例如下面的成功。

http.request('GET', 'https://bbc.com')

这发生在运行 Debian GNU/Linux 8 的 kubernetes pod 上。使用 python3.5 docker 映像。

【问题讨论】：

标签： python ssl kubernetes urllib3

【解决方案1】：

我无法在 python 3.6 docker 映像上重现这一点。您是否可能使用未预安装证书包的 slim 或 alpine 映像？

【讨论】：

【解决方案2】：

我认为它可能是 linux 的精简版。我安装了 pyopenssl 和 ndg-httpsclient，它现在可以工作了。

【讨论】：