Using requests.get with unverified certificates

Hello, I am trying to use requests module to get & post our intranet websevice that has unverified certificates. We had no issues until the new version of python that actually does verify certificates by default. What is the correct way (or is it even supported) of doing so?

What I am currently doing is that I get the certificate and public key this way:

`openssl s_client -connect 192.168.137.1:4443 | openssl x509 -pubkey > ca.crt`

The content of `ca.crt` then looks as follows:

```
 -----BEGIN PUBLIC KEY-----
...
-----END PUBLIC KEY-----
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
```

And the request I send looks like:

```
requests.get('https://192.168.137.1:4443', verify=True, cert='ca.crt')
```

which gives me error:

```
Traceback (most recent call last):
  File "req.py", line 2, in <module>
    requests.get('https://192.168.137.1:4443', verify=False, cert='testicek')
  File "/usr/local/lib/python2.7/dist-packages/requests/api.py", line 69, in get
    return request('get', url, params=params, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests/api.py", line 50, in request
    response = session.request(method=method, url=url, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests/sessions.py", line 465, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests/sessions.py", line 573, in send
    r = adapter.send(request, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests/adapters.py", line 431, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: [Errno 336265225] _ssl.c:351: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib
```

Can you please guide me what I am doing wrong?

Thank you for all your support!


Thanks for raising this issue!

The correct form of the request is:

``` python
requests.get('https://192.168.137.1:4443', verify='ca.crt')
```

The `cert` keyword argument is for client certificates.


Thank you, I just tested it, the code now looks as follows:

```
import requests
requests.get('https://192.168.137.1:4443', verify='ca.crt')
```

However when I attempt to run it, I get error:

```
Traceback (most recent call last):
  File "req.py", line 2, in <module>
    requests.get('https://192.168.137.1:4443', verify='testicek')
  File "/usr/local/lib/python2.7/dist-packages/requests/api.py", line 69, in get
    return request('get', url, params=params, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests/api.py", line 50, in request
    response = session.request(method=method, url=url, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests/sessions.py", line 465, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests/sessions.py", line 573, in send
    r = adapter.send(request, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/requests/adapters.py", line 431, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
```

Is it possible that the `ca.crt` that was generated with the previous mentioned command is incorrect? 

Thank you!


Yeah, that command is wrong. You don't want the public keys, you want the certificates themselves. It's kinda tricky to write the command, but if you run `openssl s_client -showcerts -connect 192.168.137.1:4443`, and then grab each of the `BEGIN CERTIFICATE/END CERTIFICATE` blocks and put them together in a `pem` file. Give that a shot.


Thank you! That was exactly what I needed, you're a life saver!