Python 3.6.1 的 brew 安装：[SSL: CERTIFICATE_VERIFY_FAILED] 证书验证失败

brew installation of Python 3.6.1: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed

提问by Jorge Leitao

I installed python 3.6 using

我安装了 python 3.6 使用

brew install python3

brew install python3

and tried to download a file with six.moves.urllib.request.urlretrievefrom an https, but it throws the error

并尝试six.moves.urllib.request.urlretrieve从 https下载文件，但抛出错误

ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:749)

ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] 证书验证失败 (_ssl.c:749)

In the Python installation (from .pkg), the README indicates that one needs to run the Install Certificates.commandafter the installation to

在Python安装（从.pkg）的，自述指示一个需要运行Install Certificates.command在安装后到

1. install certifi
2. symlink the certification path to certifypath

1. 安装 certifi
2. 将认证路径符号链接到certify路径

to be able to use certificates.

能够使用证书。

However, in brew install, this file does not exist and it does not seem to be run.

但是，在 brew install 中，此文件不存在，并且似乎没有运行。

回答by Jorge Leitao

It seems that, for some reason, Brew has not run the Install Certificates.commandthat comes in the Python3 bundle for Mac. The solution to this issue is to run the following script (copied from Install Certificates.command) after brew install python3:

似乎由于某种原因，Brew 没有运行Install Certificates.commandMac 的 Python3 包中的 。此问题的解决方案是在 之后运行以下脚本（复制自Install Certificates.command）brew install python3：

# install_certifi.py
#
# sample script to install or update a set of default Root Certificates
# for the ssl module.  Uses the certificates provided by the certifi package:
#       https://pypi.python.org/pypi/certifi

import os
import os.path
import ssl
import stat
import subprocess
import sys

STAT_0o775 = ( stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR
             | stat.S_IRGRP | stat.S_IWGRP | stat.S_IXGRP
             | stat.S_IROTH |                stat.S_IXOTH )


def main():
    openssl_dir, openssl_cafile = os.path.split(
        ssl.get_default_verify_paths().openssl_cafile)

    print(" -- pip install --upgrade certifi")
    subprocess.check_call([sys.executable,
        "-E", "-s", "-m", "pip", "install", "--upgrade", "certifi"])

    import certifi

    # change working directory to the default SSL directory
    os.chdir(openssl_dir)
    relpath_to_certifi_cafile = os.path.relpath(certifi.where())
    print(" -- removing any existing file or link")
    try:
        os.remove(openssl_cafile)
    except FileNotFoundError:
        pass
    print(" -- creating symlink to certifi certificate bundle")
    os.symlink(relpath_to_certifi_cafile, openssl_cafile)
    print(" -- setting permissions")
    os.chmod(openssl_cafile, STAT_0o775)
    print(" -- update complete")

if __name__ == '__main__':
    main()

回答by Claude COULOMBE

My solution for Mac OS X:

我的 Mac OS X 解决方案：

1) Upgrade to Python 3.6.5 using the native app Python installer downloaded from the official Python language website https://www.python.org/downloads/

1) 使用从 Python 语言官方网站https://www.python.org/downloads/下载的原生应用 Python 安装程序升级到 Python 3.6.5

I've found that this installer is taking care of updating the links and symlinks for the new Python a lot better than homebrew.

我发现这个安装程序在更新新 Python 的链接和符号链接方面比自制软件要好得多。

2) Install a new certificate using "./Install Certificates.command" which is in the refreshed Python 3.6 directory

2) 使用“./Install Certificates.command”安装新证书，它位于刷新后的 Python 3.6 目录中

cd "/Applications/Python 3.6/" sudo "./Install Certificates.command"

cd "/Applications/Python 3.6/" sudo "./Install Certificates.command"

回答by Ken

• find out default cafile:

• 找出默认的cafile：

python -c 'import ssl; print(ssl.get_default_verify_paths().openssl_cafile)'

/Applications/Xcode.app/Contents/Developer/Library/Frameworks/Python3.framework/Versions/3.7/etc/ssl/cert.pem

/Applications/Xcode.app/Contents/Developer/Library/Frameworks/Python3.framework/Versions/3.7/etc/ssl/cert.pem

sudo mkdir -p /Applications/Xcode.app/Contents/Developer/Library/Frameworks/Python3.framework/Versions/3.7/etc/ssl/certs

• find out ca file of certifi

• 找出ca文件 certifi

python -c 'import certifi; print(certifi.where())'

'/usr/local/lib/python3.7/site-packages/certifi/cacert.pem'

'/usr/local/lib/python3.7/site-packages/certifi/cacert.pem'

• copy to

• 复制到

sudo cp /usr/local/lib/python3.7/site-packages/certifi/cacert.pem
/Applications/Xcode.app/Contents/Developer/Library/Frameworks/Python3.framework/Versions/3.7/etc/ssl/certs/cert.pem

回答by Mak Insane

For temporary, following will disable the ssl checking,

暂时，以下将禁用 ssl 检查，

import ssl
ssl._create_default_https_context = ssl._create_unverified_context