python请求引发了SSLError，如何修复？

Question

import requests
s = requests.session()
print(s.get('https://imagetwist.com/')) # print(s.get('https://img119.imagetwist.com/'))

错误：

requests.exceptions.SSLError: HTTPSConnectionPool(host='imagetwist.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')],)",),))

如果我请求一个子域（https://img119.imagetwist.com/），它可以正常工作

有人能帮帮我吗，tks

Python 3.6.9、ubuntu 18.04.1

Answer 1

该错误说明无法验证HOST的SSL证书

因此，对于这种情况，您必须使用verify=False

检查SSL CERT Verification

这里是Disable SSL Warnings

import requests
import urllib3


urllib3.disable_warnings()

with requests.Session() as req:
    r = req.get("https://imagetwist.com/", verify=False)
    print(r)

Answer 2

更新

我冒昧地联系imagetwist.com，让他们知道这个问题。不到一小时，他们就用一个完整的证书链解决了这个问题。真是太好了

类似问题的冗余调试信息：

imagetwist.com的服务器配置不正确-它没有向共享的受信任CA提供完整的证书链。 虽然Chrome（和其他浏览器）将填补空白，但Python的库无法做到这一点

比较以下方面的结果：

openssl s_client -connect img119.imagetwist.com:443 -showcerts
openssl s_client -connect imagetwist.com:443 -showcerts

通常，服务器将提供一个证书列表，该列表将“同步”到ca_捆绑包中的证书颁发机构证书（包含您和您的计算机识别的ca的文件/目录）

有三种选择：

1. 请imagetwist.com修复其配置（祝您好运！）
2. 将他们的证书添加到您的ca_捆绑包中（每次他们更新证书时，您都必须续订）
3. 将中间产品证书添加到您的ca_bundle中

在imagetwist修复其设置之前，选项3可能是最好的长期解决方案

根据您的Python安装情况，您需要将以下内容添加到您的ca_捆绑包中，这将填充您的计算机上缺少的证书链：

  BEGIN CERTIFICATE  -
MIIGEzCCA/ugAwIBAgIQfVtRJrR2uhHbdBYLvFMNpzANBgkqhkiG9w0BAQwFADCB
iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl
cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV
BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTgx
MTAyMDAwMDAwWhcNMzAxMjMxMjM1OTU5WjCBjzELMAkGA1UEBhMCR0IxGzAZBgNV
BAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEYMBYGA1UE
ChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFJTQSBEb21haW4g
VmFsaWRhdGlvbiBTZWN1cmUgU2VydmVyIENBMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEA1nMz1tc8INAA0hdFuNY+B6I/x0HuMjDJsGz99J/LEpgPLT+N
TQEMgg8Xf2Iu6bhIefsWg06t1zIlk7cHv7lQP6lMw0Aq6Tn/2YHKHxYyQdqAJrkj
eocgHuP/IJo8lURvh3UGkEC0MpMWCRAIIz7S3YcPb11RFGoKacVPAXJpz9OTTG0E
oKMbgn6xmrntxZ7FN3ifmgg0+1YuWMQJDgZkW7w33PGfKGioVrCSo1yfu4iYCBsk
Haswha6vsC6eep3BwEIc4gLw6uBK0u+QDrTBQBbwb4VCSmT3pDCg/r8uoydajotY
uK3DGReEY+1vVv2Dy2A0xHS+5p3b4eTlygxfFQIDAQABo4IBbjCCAWowHwYDVR0j
BBgwFoAUU3m/WqorSs9UgOHYm8Cd8rIDZsswHQYDVR0OBBYEFI2MXsRUrYrhd+mb
+ZsF4bgBjWHhMA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8ECDAGAQH/AgEAMB0G
A1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAbBgNVHSAEFDASMAYGBFUdIAAw
CAYGZ4EMAQIBMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0
LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDB2Bggr
BgEFBQcBAQRqMGgwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRydXN0LmNv
bS9VU0VSVHJ1c3RSU0FBZGRUcnVzdENBLmNydDAlBggrBgEFBQcwAYYZaHR0cDov
L29jc3AudXNlcnRydXN0LmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAMr9hvQ5Iw0/H
ukdN+Jx4GQHcEx2Ab/zDcLRSmjEzmldS+zGea6TvVKqJjUAXaPgREHzSyrHxVYbH
7rM2kYb2OVG/Rr8PoLq0935JxCo2F57kaDl6r5ROVm+yezu/Coa9zcV3HAO4OLGi
H19+24rcRki2aArPsrW04jTkZ6k4Zgle0rj8nSg6F0AnwnJOKf0hPHzPE/uWLMUx
RP0T7dWbqWlod3zu4f+k+TY4CFM5ooQ0nBnzvg6s1SQ36yOoeNDT5++SR2RiOSLv
xvcRviKFxmZEJCaOEDKNyJOuB56DPi/Z+fVGjmO+wea03KbNIaiGCpXZLoUmGv38
sbZXQm2V0TP2ORQGgkE49Y9Y3IBbpNV9lXj9p5v//cWoaasm56ekBYdbqbe4oyAL
l6lFhd2zi+WJN44pDfwGF/Y4QA5C5BIG+3vzxhFoYt/jmPQT2BVPi7Fp2RBgvGQq
6jG35LWjOhSbJuMLe/0CjraZwTiXWTb2qHSihrZe68Zk6s+go/lunrotEbaGmAhY
LcmsJWTyXnW0OMGuf1pGg+pRyrbxmRE1a6Vqe8YAsOf4vmSyrcjC8azjUeqkk+B5
yOGBQMkKW+ESPMFgKuOXwIlCypTPRpgSabuY0MLTDXJLR27lk8QyKGOHQ+SwMj4K
00u/I5sUKUErmgQfky3xxzlIPK1aEn8=
  -END CERTIFICATE  -

此中间证书来自其正确配置的服务器（img119.imagetwist.com）实例

然后，我用两种方法对其进行了验证：

1. 苹果的钥匙链：openssl verify sectigo.crt
2. 使用Mozilla转换的证书链：curl https://curl.haxx.se/ca/cacert.pem | openssl verify -CAfile /dev/stdin sectigo.crt

两者都会导致：

sectigo.crt: OK
Chain:
depth=0: C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA (untrusted)
depth=1: C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority

因此，丢失的中间（Sectigo）证书由苹果默认密钥链和Mozilla的CA包中的“用户信任网络”CA进行验证