ssl cert problems

I'm having an issue with ssl verification.

```
    >>> import requests
>>> requests.get('https://myserver.tld', cert='/home/cg/cacert.pem')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python2.7/dist-packages/requests/api.py", line 63, in get
    return request('get', url, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests/safe_mode.py", line 38, in wrapped
    return function(method, url, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests/api.py", line 50, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests/sessions.py", line 238, in request
    r.send(prefetch=prefetch)
  File "/usr/local/lib/python2.7/dist-packages/requests/models.py", line 612, in send
    raise SSLError(e)
requests.exceptions.SSLError: [Errno 336265225] _ssl.c:351: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib
```

but the cacert.pem file does not seem to be the problem, as it works fine with curl?
    % curl --cacert /home/cg/cacert.pem https:/myvserver.tld
    <html><body><h1>It works!</h1></body></html>

Does anyone know what the issue here is?


the curl command prints html, I'm not sure how to escape it, but you get the picture


ok, it looks like this is an urllib3 problem, will take it there


This doesn't seem to be fixed?


@llama it isn't closed because it was fixed, it was closed because it isn't an issue with requests. It **is** an issue with a library requests relies on which @geier indicated in their last comment.


Ahh understood, thanks for that @sigmavirus24.


No problem


I'm using requests version 1.2.0 and seeing the same problem: `requests` crashes with `SSLError` on https://selectedpapers.net, whereas `openssl s_client -connect selectedpapers.net:443` verifies the certificate successfully (and any browser not IE on XP accepts the certificate;  here's another example of the same problem: http://hearsum.ca/blog/python-and-ssl-certificate-verification/).  I searched the urllib3 issue tracker but couldn't find a clear match to this bug. 

@geier @sigmavirus24 can you give a link to the urllib3 issue that tracks this?  I'd like to see whether urllib3 has actually fixed this, and if so why requests 1.2.0 still doesn't work for this https request.


@cjlee112 you're using an outdated version of requests. Re-attempt with that version and if it persists open a new issue with the details.


Oddly enough @cjlee112 running your `openssl` command on my machine ends with:

```
Verify return code: 20 (unable to get local issuer certificate)
```

But on 1.2.3 I am seeing the same SSLError because of a certificate mismatch. So the certificate you purchased will not work with requests unless you use the system certificates (which seem to work for you but not for me) by specifying as is described in the blog post you linked.

Incidentally if I do

```
openssl s_client -CApath /etc/ssl/certs/ -connect selectedpapers.net:443
```

that will verify the certificate correctly.


@sigmavirus24 Thanks for looking into this!!  I wasn't looking for a workaround, but rather trying to find the urllib3 issue number that tracks the resolution of this bug.   You guys said "it looks like this is an urllib3 problem, will take it there" but gave no details, and hunting around there I couldn't find a clear match.  I think those details should be entered here, for the record, since it strongly affects `requests` users.  For example, if `urllib3` (for whatever reason) ends up not truly fixing this bug, it will (continue to) be a big issue for people trying to use `requests`.  So the `requests` issue tracker should have an explicit record of what `urllib3` issue number(s) address this.