Bundled cacert.pem with too much certificate?

I am currently using pip and requests on SLES11SP3, which has the following software installed:
- python-2.6.8 (but I got the same behavior with a self-compiled 2.7.9)
- openssl-0.9.8j
- curl-7.19.7
- python-pip-6.0.8

I am experiencing really strange issues. With the bundled cacert.pem from requests-2.6.0, I have an SSL exception:

```
    >>> import requests
    >>> requests.get('https://pypi.python.org')
    Traceback (most recent call last):
      File "<stdin>", line 1, in <module>
      File "/root/test/lib/python2.6/site-packages/requests/api.py", line 65, in get
        return request('get', url, **kwargs)
      File "/root/test/lib/python2.6/site-packages/requests/api.py", line 49, in request
        response = session.request(method=method, url=url, **kwargs)
      File "/root/test/lib/python2.6/site-packages/requests/sessions.py", line 461, in request
        resp = self.send(prep, **send_kwargs)
      File "/root/test/lib/python2.6/site-packages/requests/sessions.py", line 573, in send
        r = adapter.send(request, **kwargs)
      File "/root/test/lib/python2.6/site-packages/requests/adapters.py", line 431, in send
        raise SSLError(e, request=request)
    requests.exceptions.SSLError: [Errno 1] _ssl.c:491: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
```

This behavior is confirmed with curl:

```
# curl --capath /dev/null --cacert cacert.pem.requests https://pypi.python.org
curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
```

However, if I remove any of the last 4 certificates in the bundle, everything works as expected. Currently, the last 4 issuers are:

```
# Issuer: CN=CA Disig Root R1 O=Disig a.s.
# Issuer: CN=CA Disig Root R2 O=Disig a.s.
# Issuer: CN=ACCVRAIZ1 O=ACCV OU=PKIACCV
# Issuer: CN=TWCA Global Root CA O=TAIWAN-CA OU=Root CA
```

Do you have any idea why? Is it linked to openssl being too old? Unfortunately, I can't upgrade it, it is a system library. But modifying every virtualenv I create on this machine to change the bundle will be a pain…


I'm not finding any problem on my ubuntu machine. I also find it particularly hard to understand this problem because none of those four certificates have anything to do with the trust path:

```
---
Certificate chain
 0 s:/businessCategory=Private Organization/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=Delaware/serialNumber=3359300/street=16 Allen Rd/postalCode=03894-4801/C=US/ST=NH/L=Wolfeboro,/O=Python Software
Foundation/CN=www.python.org
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
---
```

That makes me tempted to say the problem is that OpenSSL is too old.


That's why I'm just asking for expertise here. I know there is nothing related with those certificates. It also works on my openSuse 13.2, but on SLES 11 SP3 (and it was also the case on the very old SLES 10), I need this **ugly** workaround…
It might be related to openssl, but in which way the number, or the type of certificates in a PEM file changes its behavior?


I've definitely seen this problem before and it's definitely a bug in openssl.


Stupid question, what architecture are you using on 13.2, SLES11SP3, and SLES10. I can't find where I've seen this before, but I'm still looking.


Architecture? Do you mean x86_64?

By the way, I'm recompiling openssl, and it _seems_ to work. However, I think that overriding system libraries is not a good idea :cry: 


I'm closing this issue, since it is not related to requests. However, for anyone looking for help using Suse Linux Enterprise, don't be surprised: you'll have to recompile openssl, and it's not hassle-free at all.