Python请求SSL错误-证书验证失败
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/46604114/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Python requests SSL error - certificate verify failed
提问by Oliver
This code
这段代码
import requests
requests.get("https://hcaidcs.phe.org.uk/WebPages/GeneralHomePage.aspx")
is giving me this error
给我这个错误
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:777)
I know practically nothing about SSL, but I've tried downloading the site's certificate and pointing to that file using the verifyoption, but it hasn't worked. Am I missing something?
我几乎对 SSL 一无所知，但我尝试下载站点的证书并使用该verify选项指向该文件，但它没有奏效。我错过了什么吗？
回答by Steffen Ullrich
As already pointed out in a comment: the site has a bad SSL implementation as can be seen from the SSLLabs report. The main part of this report regarding your problem is:
正如评论中已经指出的那样：从SSLLabs 报告中可以看出，该站点的 SSL 实现不佳。本报告关于您的问题的主要部分是：
This server's certificate chain is incomplete. Grade capped to B.
此服务器的证书链不完整。等级上限为 B。
This means that the server is not sending the full certificate chain as is needed to verify the certificate. This means you need to add the missing certificates yourself when validating. For this you need to include the PEM for the missing chain certificate C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CAand also for the root CA C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CAinfo a file my_trust_store.pemand then you can call:
这意味着服务器不会发送验证证书所需的完整证书链。这意味着您需要在验证时自己添加缺少的证书。为此，您需要为缺少的链证书C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA以及根 CA C=US, O=包含 PEM DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA信息文件my_trust_store.pem，然后您可以调用：
requests.get("https://...", verify='my_trust_store.pem')
... but I've tried downloading the site's certificate and pointing to that file using the verify option
...但我已经尝试下载站点的证书并使用验证选项指向该文件
This will not work with normal leaf certificates. Since the SSL stack of Python is based on OpenSSL and OpenSSL expects only trusted certificate authorities in the trust store (i.e. given with verify) and a server certificate is not CA certificate it will not help to add it to the trust store.
这不适用于普通叶证书。由于 Python 的 SSL 堆栈基于 OpenSSL，并且 OpenSSL 只需要信任存储中的受信任证书颁发机构（即使用verify），并且服务器证书不是 CA 证书，因此将其添加到信任存储中无济于事。
回答by kerberos
import requests
html = requests.get("https://hcaidcs.phe.org.uk/WebPages/GeneralHomePage.aspx",verify=False).text
You should write it like this, and I've verified it
你应该这样写，我已经验证过了
