SSLError: bad handshake (ssl3_get_server_certificate, certificate verify failed)

After updating the Let's Encrypt certificate I use on my host (from one that uses one host to one that has multiple hostnames), a requests-using script I have started failing:

```
  File "test.py", line 5, in get
    rsp = requests.get(url)
  File "/usr/lib/python2.7/site-packages/requests/api.py", line 69, in get
    return request('get', url, params=params, **kwargs)
  File "/usr/lib/python2.7/site-packages/requests/api.py", line 50, in request
    response = session.request(method=method, url=url, **kwargs)
  File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 468, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 597, in send
    history = [resp for resp in gen] if allow_redirects else []
  File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 195, in resolve_redirects
    **adapter_kwargs
  File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 576, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python2.7/site-packages/requests/adapters.py", line 433, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: ("bad handshake: Error([('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')],)",)
```

I have requests-2.8.1, certifi-2015.11.20, urllib3-1.14 and openssl-1.0.2g. The affected host is https://xavamedia.nl/.


What OS and Python version do you have?


Oh, nevermind, I've spotted it. Your intermediate certificate is wrong.

A quick check using OpenSSL shows that you've served the following certificate chain:

```
 0 s:/CN=xavamedia.nl
   i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
 1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X1
   i:/O=Digital Signature Trust Co./CN=DST Root CA X3
```

You'll notice that your leaf cert (cert 0) is issued by "Let's Encrypt Authority X3", but the intermediate cert you sent belongs to "Let's Encrypt Authority X1". That's not right at all. I don't know how you're setting up those certs, but you'll need to ensure that you're serving the appropriate intermediate certificate, because neither requests nor certifi ships intermediate certs in their bundles.


Doh, that's dumb. I guess I would have expected my browser (Firefox) to flag that sort of issue...


Sadly, most browsers _do_ ship a list of intermediate certificates for this very reason: misconfigured TLS servers are extremely common. We don't do it only because such a list would be really quite brutal to maintain.


@Lukasa How did you do the quick check with openssl?  I've having the same problem, and suspect I may have the same cause.


@singletoned `openssl s_client -connect <host>:<port> -showcerts` should do the trick.


That's brilliant, thanks.  And thanks for the blisteringly fast response!


No problem!


 File "download.py", line 31, in <module>
    req = requests.get(zipURL, stream=True)#, verify=False)
  File "C:\Program Files\Anaconda3\lib\site-packages\requests\api.py", line 72, in get
    return request('get', url, params=params, **kwargs)
  File "C:\Program Files\Anaconda3\lib\site-packages\requests\api.py", line 58, in request
    return session.request(method=method, url=url, **kwargs)
  File "C:\Program Files\Anaconda3\lib\site-packages\requests\sessions.py", line 502, in request
    resp = self.send(prep, **send_kwargs)
  File "C:\Program Files\Anaconda3\lib\site-packages\requests\sessions.py", line 612, in send
    r = adapter.send(request, **kwargs)
  File "C:\Program Files\Anaconda3\lib\site-packages\requests\adapters.py", line 514, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: ("bad handshake: Error([('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')],)",)

Hi Lukasa, I believe I have the same problem. I've searched here and there and have not solved the problem. Do you know what's going wrong at my end? Thank you.

Seems we're failing to validate the cert. is the server you're contacting on the public internet?

@Lukasa : I'm having the same issue while interacting with vision.goolgeapis.com

No, my network is not public.

Do you think think might be because of the firewall ?

If you have an intercepting proxy in between you and the endpoint then yes, frequently you'll fail to validate that certificate.