我试图连接到一个通过https使用非官方CA的网站。由于某些原因,它适用于curl,但不适用于python请求。
参见下面的示例
Python 3.8.0 (default, Oct 30 2019, 11:47:54)
Type 'copyright', 'credits' or 'license' for more information
IPython 7.9.0 -- An enhanced Interactive Python. Type '?' for help.
In [1]: import requests
In [2]: requests.__version__
Out[2]: '2.22.0'
In [3]: cert = "..."
In [4]: url = "..."
In [5]: !curl --cacert {cert} {url}
{"status":200}
In [6]: requests.get(url,verify=cert)
---------------------------------------------------------------------------
SSLCertVerificationError Traceback (most recent call last)
...
SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get issuer certificate (_ssl.c:1108)
During handling of the above exception, another exception occurred:
MaxRetryError: HTTPSConnectionPool(host='...', port=443): Max retries exceeded with url: ... (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get issuer certificate (_ssl.c:1108)')))
During handling of the above exception, another exception occurred:
SSLError Traceback (most recent call last)
...
SSLError: HTTPSConnectionPool(host='...', port=443): Max retries exceeded with url: ... (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get issuer certificate (_ssl.c:1108)')))我做错了什么?为什么它的行为不同?
-编辑--
curl确实使用了此证书,但没有curl失败。
In [9]: !curl {url}
curl: (60) server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
More details here: http://curl.haxx.se/docs/sslcerts.html
...
In [10]: 发布于 2020-10-15 09:06:06
..。这是一个中间CA
仅在信任存储中拥有中间CA不足以验证证书,至少在当前版本的Python中是如此。此特性需要使用OpenSSL标志X509_V_FLAG_PARTIAL_CHAIN进行验证,这是目前都没有被Python公开,默认情况下也不设置。
与此相反,在较新的版本中使用的是卷曲默认情况下设置此标志。,因此可以工作。
https://stackoverflow.com/questions/64219172
复制相似问题