Python: ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate. How do I fix it without turning off verification?

Cause: Python couldn't build a trusted chain from the server's certificate to a root it trusts. The usual reasons: - macOS with the python.org installer: that Python ships its own OpenSSL and doesn't use the macOS keychain until you install a CA bundle. - A corporate proxy or antivirus that intercepts TLS and re-signs traffic with its own root CA, which isn't in Python's or certifi's bundle. - An outdated CA bundle (old certifi), or a server that doesn't send its intermediate certificate. How to check: - Look at the chain: openssl s_client -connect host:443 -servername host -showcerts. If the issuer is your company's or your antivirus's CA, it's interception. If the server sends only its leaf certificate, the server is misconfigured (missing intermediate). - Check which bundle Python uses: python -c "import ssl; print(ssl.get_default_verify_paths())" and, for requests, python -c "import certifi; print(certifi.where())". Fix (pick the one that matches the cause): 1. macOS python.org Python: run the 'Install Certificates.command' in /Applications/Python 3.x/, which installs certifi and links it. 2. Update the bundle: pip install --upgrade certifi (requests and httpx use certifi by default). 3. Corporate interception: get your organization's root CA as a PEM file and point tools at a bundle that includes it: REQUESTS_CA_BUNDLE or SSL_CERT_FILE for Python code, pip config set global.cert /path/ca.pem for pip. Or install the truststore package and call truststore.inject_into_ssl() so Python uses the operating system's trust store, which IT usually already manages. 4. Server missing its intermediate: fix the server to send the full chain; don't work around it on every client. Avoid verify=False or PYTHONHTTPSVERIFY=0: they switch off protection against interception completely, and they tend to stay in code long after the fix. After: run the same request again and confirm it succeeds with verification on; if you added a corporate CA, keep it in one place (system store or a single bundle file) so it's easy to update. Sources: https://docs.python.org/3/library/ssl.html https://requests.readthedocs.io/en/latest/user/advanced/#ssl-cert-verification https://truststore.readthedocs.io/