`ImportError: No module named certifi` when using SSL

I did a fresh clone of the requests repo and get the following traceback when I try to POST to the following endpoint:

``` python
>>> requests.post('https://api.dropbox.com/1/oauth/request_token')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "requests/api.py", line 83, in post
    return request('post', url, data=data, **kwargs)
  File "requests/api.py", line 38, in request
    return s.request(method=method, url=url, **kwargs)
  File "requests/sessions.py", line 200, in request
    r.send(prefetch=prefetch)
  File "requests/models.py", line 454, in send
    cert_loc = __import__('certifi').where()
ImportError: No module named certifi
```

This was after I attempted to run `python setup.py build` and navigated to the `build/lib` directory.

I realize that Requests leverages the full breadth of existing http packages out there, but do I really need to download an external dependency just to get out through https?  Is there some way a fallback stub could be put in the place of this package?

Overall I'm in love with Requests and think the job you guys are doing is awesome.  Keep up the great work!


Traditionally, requests has had 0 dependencies. With the new SSL support, a pem file must be distributed for standard validation. I'm using mozilla's. Mozilla's is GPL. So, certifi (which contains their pen file) is a separate module, and must be distributed as such. 

You can make ssl requests without it, you just need to specify another pem file or turn verification off.


Trust me, I hate it more than you do ;)


IMO dependency isn't a big deal thanks to pip and setup script options that will check for them. What's the reason you hate them?


I do a lot of App Engine.  On App Engine, you don't have `pip`, you don't have `setuptools`, or anything really for that matter.  You can't even run dependencies that aren't pure Python.  No dependency tracker can hear you scream in the vacuum of space!


Scary.


I would love to have no dependencies, but it's a requirements of the licensing. Plus, having the certs decoupled from the module is also nice, so they aren't tied to one another.


I sympathize with your wishes and empathize with your licensing woes. :scream:


Somewhat unrelated, but I believe that certdata.txt is also licensed under LGPL (if you read the header of the certdata.txt file itself, as well as the curl reference [page](http://curl.haxx.se/docs/caextract.html)) as well as GPL and MPL.


@cactus yes, and they are all equally incompatible ;)


The file certdata.txt has a license, but the certificates themselves are free to distribute. right?
Why not generating the file yourself by exporting all the certificates in a file?
On macosx it is easy with the 'keychain', you select 'system roots' and select all the root cert you want them 'file -> export items' and you'll have a file with all certs in pem format.


Correct.

If someone else can find a heavily maintained and accepted CA bundle (I tried), I'd be happy to use it instead. Mozilla's put a lot of work into that list though, and it's update quite frequently.


I don't see how LGPL is incompatible, as use of a cert chain would (in my mind) fall very clearly under use 'as a library' and not be considered a derivative. I am by no means a master of software license law though. 

Interestingly, the tornado project includes this file in their package and [repo](https://github.com/facebook/tornado/blob/master/tornado/ca-certificates.crt) (for use in their http_client)  and tornado itself is apache-2.0 licensed.


Anyone using tornado and packaging that file within their application is now subject to the GPL/MPL.


As that file is licensed under the gpl _or_ mpl, and reading the actual wording of the licenses, I don't see how that is the case. However, I am not a lawyer, don't deal with license issues often, etc. (some interesting references anyway: [here](http://www.mail-archive.com/modssl-users@modssl.org/msg16980.html), [here](https://en.wikipedia.org/wiki/Mozilla_Public_License#Compatibility_with_other_licenses), [here](http://www.mozilla.org/MPL/mpl-faq.html) (see points 6 and 7))

That said, instead of including the file itself, would it would be enough to document that if you want to use https, you need to configure requests to point at your system ssl ca-certificates bundle? (and/or refer people to the libcurl page showing how to download a version for themselves)? Perhaps with a config.defaults configuration value for the path to the bundle/pem?


No, it needs to be 100% completely seamless.

Requests is HTTP for Humans. Not machines.

Web browsers don't require you to read documentation, download an obscure file, place it in a folder, and configure your system to use it in order to have verified SSL. Neither should your Python HTTP client.


heh. Fair point. :)


Hey guys,

Sorry to beat a dead horse, so to speak.  My issue has been exacerbated now that I want to need to do some SSL requests at work. :sob:

What is the recommended way of getting a cert into requests without `certifi`?

I'd like to avoid having to make a `certifi` stub which I write myself to get around the GPL, and it sounds like there aren't simple configuration hooks at present.

I wouldn't mind adding them & submitting a changeset if it is in line with the philosophy of Requests, or, alternatively, creating a separate repo which stubs certifi but doesn't restrict you to GPL.  Basically I just need a non-GPL way to get the cert in without having to think about it.

Cheers,

--mvv :tophat:


You can also pass `verify` the path to a CA_BUNDLE file for private certs. You can also set the `REQUESTS_CA_BUNDLE` environment variable.


Awesome!  I'm off to the races. Thanks for the pro tip. :v:


Let me know if you have any problems :)


So if your only goal was to get SSL URLS working with requests, what are the steps?  I don't care about licensing restrictions, I just want it to work.  What do I need to download and install for it to work?

Thanks so much for your hard work.


@davidpshaw a simple `pip install requests` takes care of everything.

If you're just having the certifi is missing error, `pip install certifi`.


@kennethreitz Thanks, I had same issue and is resolved by that command
`pip install requests` just saved my life.