WARNING - [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

As of August 30, 2014, seeing this error on every request. Server is Ubuntu 12.04:

```
$ cat /etc/*-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=12.04
DISTRIB_CODENAME=precise
DISTRIB_DESCRIPTION="Ubuntu 12.04.5 LTS"
NAME="Ubuntu"
VERSION="12.04.5 LTS, Precise Pangolin"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu precise (12.04.5 LTS)"
VERSION_ID="12.04"
```

Running requests 2.0.1. Tried upgrading to 2.1.0 as I saw CA Bundle was updated then, to no avail.

```
>>> import requests
>>> requests.__version__
'2.1.0'
```


Is it safe to assume that you're using `apt` to install requests? If so, I'm not sure they will continue to vendor the `cacert.pem` file like we do. So it could be that they force the default to be the system store. I'll fire up a virtual machine soon to check on this.

For the record, the latest version is 2.4.0.


I answered my own question. It seems that the default ubuntu repositories ship v0.8.2 as python-requests. I installed 2.0.1 with pip on 12.04 and 2.1.0 and I'm not seeing any errors. Can you provide the URLs you're trying to use as well as any information about proxies that you may be using?


This is almost certainly because you're using the system trust store, not ours.

You can test it by installing the `certifi` package and then running `r = requests.get(your_url, verify=certifi.where()`.


No, we're installing requests via pip in a virtualenv.


Obligatory question whether the system time is correct.


@Lukasa still doesn't work:

```
Python 2.7.3 (default, Sep 26 2013, 20:03:06)
[GCC 4.6.3] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import requests
>>> requests.__version__
'2.1.0'
>>> requests.get('https://graph.facebook.com/spotify')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/data/app/local/lib/python2.7/site-packages/requests/api.py", line 55, in get
    return request('get', url, **kwargs)
  File "/data/app/local/lib/python2.7/site-packages/requests/api.py", line 44, in request
    return session.request(method=method, url=url, **kwargs)
  File "/data/app/local/lib/python2.7/site-packages/requests/sessions.py", line 382, in request
    resp = self.send(prep, **send_kwargs)
  File "/data/app/local/lib/python2.7/site-packages/requests/sessions.py", line 485, in send
    r = adapter.send(request, **kwargs)
  File "/data/app/local/lib/python2.7/site-packages/requests/adapters.py", line 379, in send
    raise SSLError(e)
requests.exceptions.SSLError: [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
>>> import certifi
>>> certifi.__version__
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
AttributeError: 'module' object has no attribute '__version__'
>>> requests.get('https://graph.facebook.com/spotify', verify=certifi.where())
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/data/app/local/lib/python2.7/site-packages/requests/api.py", line 55, in get
    return request('get', url, **kwargs)
  File "/data/app/local/lib/python2.7/site-packages/requests/api.py", line 44, in request
    return session.request(method=method, url=url, **kwargs)
  File "/data/app/local/lib/python2.7/site-packages/requests/sessions.py", line 382, in request
    resp = self.send(prep, **send_kwargs)
  File "/data/app/local/lib/python2.7/site-packages/requests/sessions.py", line 485, in send
    r = adapter.send(request, **kwargs)
  File "/data/app/local/lib/python2.7/site-packages/requests/adapters.py", line 379, in send
    raise SSLError(e)
requests.exceptions.SSLError: [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
```


@t-8ch system time is correct.

Oddly, requests made with the oauth2 lib works when I use certify:

```
import oauth2 as oauth
import certifi
...
client = oauth.Client(self._consumer, token)
client.ca_certs = certifi.where()
```


Requests 2.1.0 likely has an older copy of the trust store. Try this:

``` python
import requests
import certifi

r = requests.get('https://graph.facebook.com/spotify', verify=certifi.where())
```


The openssl s_client command gives way better error messages than the ssl module

``` sh
openssl s_client -connect graph.facebook.com:443 -CAfile $(python -m certifi)
```


@Lukasa i did try it with cerifi above, it still fails

```
>>> import certifi
>>> requests.get('https://graph.facebook.com/spotify', verify=certifi.where())

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/data/app/local/lib/python2.7/site-packages/requests/api.py", line 55, in get
    return request('get', url, **kwargs)
  File "/data/app/local/lib/python2.7/site-packages/requests/api.py", line 44, in request
    return session.request(method=method, url=url, **kwargs)
  File "/data/app/local/lib/python2.7/site-packages/requests/sessions.py", line 382, in request
    resp = self.send(prep, **send_kwargs)
  File "/data/app/local/lib/python2.7/site-packages/requests/sessions.py", line 485, in send
    r = adapter.send(request, **kwargs)
  File "/data/app/local/lib/python2.7/site-packages/requests/adapters.py", line 379, in send
    raise SSLError(e)
requests.exceptions.SSLError: [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
```


@t-8ch NICE! That exposed the issue. The problem is that we were statically routing in /etc/hosts through an Nginx proxy with a self-signed cert :) Closing as this is not a requests issue.

Thanks for all your help guys!


@stantonk Hi, how did you solve the issue specifically. I've ran into the same particular issue. I'm using a self signed certificate served via gunicorn


This is not the place to discuss non-requests related problems. Please take your conversation to email.