Certificate Verification When Using Virtual Environments

Question

I have a CA root certificate installed on my machine, and everything is fine when issuing requests when using the system request library installation:

$ python -c 'import requests; print requests.get("https://example.com")' <Response [200]> 

However, if I issue the same request from a virtual environment, certificate verification fails:

 $ python -c 'import requests; print requests.get("https://example.com")' requests.exceptions.SSLError: [Errno 1] _ssl.c:510: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 

Using requests.certs.where , I see that the system installation uses a set of system CAs, and the virtual environment uses a set of CAs that comes with requests:

 $ python -c "import requests; print requests.certs.where()" /etc/ssl/certs/ca-certificates.crt $ (venv) python -c "import requests; print requests.certs.where()" .../venv/local/lib/python2.7/site-packages/requests/cacert.pem 

Is there another solution for collecting system certificates without specifying a path for each request when using virtualenv , ie:

 >>> requests.get("https://example.com" verify="/etc/ssl/certs/ca-certificates.crt") 

Answer 1

The system package was installed using the system package manager and was changed so that requests.certs.where returned the system package CA /etc/ssl/certs/ca-certificates.crt . Inside the virtual environment, requests installed through pip, so it uses the associated cacert.pem .

Looking at the source of requests.certs pointed me to python-certifi . The solution I used to solve my problem was to create a python-certifi style package containing root certificates for the sites I need.

 from my_certifi import where requests.get("https://example.com" verify=where()) 

Now any requests to https://example.com will be checked without the need for any system-specific changes or configuration.