From nobody Sat Jan 10 23:17:38 2026 X-Original-To: python@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dpZLB2shzz6N3km for ; Sat, 10 Jan 2026 23:17:38 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dpZLB2jlfz3dBn for ; Sat, 10 Jan 2026 23:17:38 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1768087058; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=2h7sYsFFelyFwYCl/PWrW8sUc+mt6q5Ss3Ga4JH4w1I=; b=r26gYmEHFBbMAIzOzB7k0zvCn6t9WZw1hirvDzPR9KRvu31NPGBvQwr+h1tC6Yr1nqm5fd Er0lAsO0maNOPJXuir/d/qC9jrFLCIncy4g1K5XzuqkFf79+XpXEN6Fu16RkphoTWKNPcA aNN90pJld+835GpCA9EffV5xIp5sGWuqQlyrh7HzsYVP/A9Ynz1KcWHFwt7LCUl7v2atsn uh7/+RiwEPDO9lOxupUI+VZeyjeUBoz/8iREIDOHY3NNQF3SXn8R5LptRdTBoOy9mPWxAn sQpoRX8IoOSXo2l56y7908auDl+a7FuOAhD0CvofUa/ivnM46D2e53KNrPyc5w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1768087058; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=2h7sYsFFelyFwYCl/PWrW8sUc+mt6q5Ss3Ga4JH4w1I=; b=xSnF+qCKlDHszLLQ5mSSFSeivgmaJeTTzv3VUknRrdYK6yerzDGhSTQmNYNUECk7vzC3Nk JAmYiEExWKZGkmC1jODowaRkn02QdR1lUqik0q5lQEb//QST/w+EYBOEQribRpra6n8/Y/ L/aXGpZiloMUz41EexWgpZ7cSPFJ1TC552bsQVulOPMdL5AJO/Kb7y9P90JCKaoTby1mWa MZ+6n8Z2t4XEcV+BU+Vw96xae14XLKaZbpLid1aOnIsTz1RZViKMkLuv7RsSDYycac6xYH H2mGbplgVEQCELfR3LpxeakLSKrHYv64lmTdqdcaYrDDCElQ18AfhCuJ302tVA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1768087058; a=rsa-sha256; cv=none; b=McKwrMbbZofIg1PCtcHvV21jNLkwDmoAsh8m+hqN8d13VEb/mDiAadmuw4sSsZz+XgUTju 4o/ulyw0v3HBTvKCgAJNRccpx7tiy3o3uoVZTmp1gVdxrBa7GILqyxLwtXmFeIpB7vM4MN DVE7k4YNp20o1AvNZdCVRNU10DjtK/hqO/f+yL+ZGJNaHcuQZW62wzpPZAmY3xnfVbuO4D SBxXVY+PZt+POGoleZxQ6I0CP9CufL4+IyYDgI1IXC3oaIITbV60qFsiAM6Nn+pa9eTdu5 hlje67npfnadpk6rMKdJ5q+IH2//itHThy8kFgVK6lnWmE04bcWEyX24TEklnQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4dpZLB2GB0zv4 for ; Sat, 10 Jan 2026 23:17:38 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 60ANHc2Q049306 for ; Sat, 10 Jan 2026 23:17:38 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 60ANHcDb049305 for python@FreeBSD.org; Sat, 10 Jan 2026 23:17:38 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: python@FreeBSD.org Subject: [Bug 251562] security/py-certifi: SSLError 'certificate verify failed' despite correct looking /etc/ssl/cert.pem Date: Sat, 10 Jan 2026 23:17:38 +0000 X-Bugzilla-Reason: AssignedTo CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Ports & Packages X-Bugzilla-Component: Individual Port(s) X-Bugzilla-Version: Latest X-Bugzilla-Keywords: needs-patch, needs-qa X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: michaelo@FreeBSD.org X-Bugzilla-Status: Open X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: python@FreeBSD.org X-Bugzilla-Flags: maintainer-feedback? X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: FreeBSD-specific Python issues List-Archive: https://lists.freebsd.org/archives/freebsd-python List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-python@freebsd.org Sender: owner-freebsd-python@FreeBSD.org MIME-Version: 1.0 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D251562 --- Comment #7 from Michael Osipov --- (In reply to Benjamin Takacs from comment #6) No, buth they are fundamentally different. While certifi reinvents the wheel (no pun intended), truststore truly instructs OpenSSL to use its default truststore. Certifi is capable of using anything outside of the Mozilla bun= dle. [1] was the successor to certifi and the predecessor to truststore. You need to do: > import truststore > truststore.inject_into_ssl() but in applications only, not in libraries! Ideally the dependent ports you have mentioned would solve it upstream, not downstream. Stuff like py-sphin= x is a good candidate because it is CLI. Affected ports: > $ grep -r --include=3DMakefile /py-certifi . > ./astro/py-skyfield/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>0:= security/py-certifi@${PY_FLAVOR} > ./astro/py-skyfield/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>0:= security/py-certifi@${PY_FLAVOR}\ > ./comms/py-pynitrokey/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>= =3D14.5.14,:security/py-certifi@${PY_FLAVOR} \ > ./comms/py-pynitrokey/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>= =3D14.5.14,:security/py-certifi@${PY_FLAVOR} \ > ./databases/py-snowflake-connector-python/Makefile: ${PYTHON_= PKGNAMEPREFIX}certifi>=3D2017.4.17:security/py-certifi@${PY_FLAVOR} \ > ./devel/oci-cli/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>0:= security/py-certifi@${PY_FLAVOR} \ > ./devel/py-cibuildwheel/Makefile: ${PYTHON_PKGNAMEPREFIX}ce= rtifi>0:security/py-certifi@${PY_FLAVOR} \ > ./devel/py-geventhttpclient/Makefile: ${PYTHON_PKGNAMEPREFIX}ce= rtifi>=3D0:security/py-certifi@${PY_FLAVOR} \ > ./devel/py-gptscript/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}= certifi>=3D2024.2.2:security/py-certifi@${PY_FLAVOR} \ > ./devel/py-minio/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}certifi>= =3D0:security/py-certifi@${PY_FLAVOR} \ > ./devel/py-oci/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}certifi>= 0:security/py-certifi@${PY_FLAVOR} \ > ./devel/py-pdm/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>= =3D2024.8.30:security/py-certifi@${PY_FLAVOR} \ > ./devel/py-pipenv/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}certifi>= =3D0:security/py-certifi@${PY_FLAVOR} \ > ./devel/py-sentry-sdk/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}= certifi>=3D0:security/py-certifi@${PY_FLAVOR} \ > ./devel/py-tiamat/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}certifi>= =3D0:security/py-certifi@${PY_FLAVOR} \ > ./finance/electrum/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>0:= security/py-certifi@${PY_FLAVOR} \ > ./finance/py-ccxt/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}certifi>= =3D2018.1.18:security/py-certifi@${PY_FLAVOR} \ > ./finance/py-valinvest/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}= certifi>=3D2022.12.7:security/py-certifi@${PY_FLAVOR} > ./graphics/py-fiona/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>0:= security/py-certifi@${PY_FLAVOR} \ > ./graphics/py-pyogrio/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}= certifi>=3D0:security/py-certifi@${PY_FLAVOR} \ > ./graphics/py-pyproj/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}= certifi>=3D0:security/py-certifi@${PY_FLAVOR} > ./graphics/py-rasterio/Makefile: ${PYTHON_PKGNAMEPREFIX}ce= rtifi>=3D0:security/py-certifi@${PY_FLAVOR} \ > ./math/py-matplotlib/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>= =3D0.10:security/py-certifi@${PY_FLAVOR} \ > ./math/py-matplotlib/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>= =3D0.10:security/py-certifi@${PY_FLAVOR} \ > ./misc/py-google-genai/Makefile: ${PYTHON_PKGNAMEPREFIX}ce= rtifi>=3D2024.8.30:security/py-certifi@${PY_FLAVOR} \ > ./misc/py-napari/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>= =3D2018.1.18:security/py-certifi@${PY_FLAVOR} \ > ./multimedia/streamlink/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}= certifi>0:security/py-certifi@${PY_FLAVOR}\ > ./multimedia/syncplay/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>= =3D0:security/py-certifi@${PY_FLAVOR} \ > ./net-mgmt/py-msrest/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>= =3D2017.4.17:security/py-certifi@${PY_FLAVOR} \ > ./net-p2p/py-pulsar-client/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAM= EPREFIX}certifi>0:security/py-certifi@${PY_FLAVOR} > ./net/py-twitter-tools/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}= certifi>0:security/py-certifi@${PY_FLAVOR} > ./net/py-urllib31/Makefile:SSL_RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}= certifi>=3D0:security/py-certifi@${PY_FLAVOR} \ > ./security/py-cryptography/Makefile: ${PYTHON_PKGNAMEPREFIX}ce= rtifi>=3D2024:security/py-certifi@${PY_FLAVOR} \ > ./security/py-nethsm/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}= certifi>=3D14.5.14,:security/py-certifi@${PY_FLAVOR} \ > ./security/py-plaso/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>= =3D0:security/py-certifi@${PY_FLAVOR} \ > ./security/py-signxml/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}= certifi>=3D2023.11.17:security/py-certifi@${PY_FLAVOR} \ > ./sysutils/py-kubernetes/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}= certifi>=3D14.05.14:security/py-certifi@${PY_FLAVOR} \ > ./textproc/py-elastic-transport/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAM= EPREFIX}certifi>=3D0:security/py-certifi@${PY_FLAVOR} \ > ./textproc/py-elasticsearch-curator/Makefile: ${PYTHON_PKGNAMEP= REFIX}certifi>=3D2018.10.15:security/py-certifi@${PY_FLAVOR} \ > ./textproc/py-elasticsearch7/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAM= EPREFIX}certifi>=3D0:security/py-certifi@${PY_FLAVOR} \ > ./textproc/py-evtx2splunk/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}= certifi>0:security/py-certifi@${PY_FLAVOR} \ > ./textproc/py-jq/Makefile:TEST_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}certifi>= =3D0:security/py-certifi@${PY_FLAVOR} \ > ./textproc/py-opensearch-py/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAM= EPREFIX}certifi>=3D0:security/py-certifi@${PY_FLAVOR} \ > ./www/buku/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>=3D0:secur= ity/py-certifi@${PY_FLAVOR} \ > ./www/firedm/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>0:security= /py-certifi@${PY_FLAVOR} \ > ./www/py-aioquic/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}certifi>= =3D0:security/py-certifi@${PY_FLAVOR} \ > ./www/py-calibreweb/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>= =3D0:security/py-certifi@${PY_FLAVOR} \ > ./www/py-httpcore/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}certifi>= =3D0:security/py-certifi@${PY_FLAVOR} \ > ./www/py-httpx/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>= =3D0:security/py-certifi@${PY_FLAVOR} \ > ./www/py-nicegui/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>= =3D0:security/py-certifi@${PY_FLAVOR} \ > ./www/py-primp/Makefile:TEST_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}certifi>= 0:security/py-certifi@${PY_FLAVOR} \ > ./www/py-puppetboard/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}= certifi>=3D2025.4.26:security/py-certifi@${PY_FLAVOR} \ > ./www/py-requests/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}certifi>= =3D2017.4.17:security/py-certifi@${PY_FLAVOR} \ > ./www/py-searxng-devel/Makefile: ${PYTHON_PKGNAMEPREFIX}ce= rtifi>=3D0:security/py-certifi@${PY_FLAVOR} \ > ./www/py-selenium-wire/Makefile: ${PYTHON_PKGNAMEPREFIX}ce= rtifi>=3D2019.9.1:security/py-certifi@${PY_FLAVOR} \ > ./www/py-selenium/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>= =3D2021.10.8:security/py-certifi@${PY_FLAVOR} > ./www/py-sherlock-project/Makefile:RUN_DEPENDS=3D ${PYTHON_PKGNAMEPREFIX}= certifi>=3D2019.6.16:security/py-certifi@${PY_FLAVOR} \ > ./www/py-yt-dlp/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>0:= security/py-certifi@${PY_FLAVOR} \ > ./www/yt-dlp/Makefile: ${PYTHON_PKGNAMEPREFIX}certifi>0:security= /py-certifi@${PY_FLAVOR} \ Some of them I do use, some are really weird because why does matplotlib require it at build time. Test: > osipovmi@deblndw011x:/tmp/test-venv/create > $ source bin/activate > osipovmi@deblndw011x:/tmp/test-venv/create > $ pip list > Package Version > ---------- ------- > pip 23.0.1 > setuptools 65.5.0 >=20 > [notice] A new release of pip is available: 23.0.1 -> 25.3 > [notice] To update, run: pip install --upgrade pip > osipovmi@deblndw011x:/tmp/test-venv/create > $ pip install requests > Collecting requests > Downloading requests-2.32.5-py3-none-any.whl (64 kB) > =E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2= =94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94= =81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81= =E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2= =94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81 64.7/= 64.7 kB 669.9 kB/s eta 0:00:00 > Collecting urllib3<3,>=3D1.21.1 > Downloading urllib3-2.6.3-py3-none-any.whl (131 kB) > =E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2= =94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94= =81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81= =E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2= =94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81 131.6= /131.6 kB 690.6 kB/s eta 0:00:00 > Collecting charset_normalizer<4,>=3D2 > Downloading charset_normalizer-3.4.4-py3-none-any.whl (53 kB) > =E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2= =94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94= =81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81= =E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2= =94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81 53.4/= 53.4 kB 1.5 MB/s eta 0:00:00 > Collecting idna<4,>=3D2.5 > Downloading idna-3.11-py3-none-any.whl (71 kB) > =E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2= =94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94= =81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81= =E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2= =94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81 71.0/= 71.0 kB 1.9 MB/s eta 0:00:00 > Collecting certifi>=3D2017.4.17 > Downloading certifi-2026.1.4-py3-none-any.whl (152 kB) > =E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2= =94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94= =81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81= =E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2= =94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81=E2=94=81 152.9= /152.9 kB 1.4 MB/s eta 0:00:00 > Installing collected packages: urllib3, idna, charset_normalizer, certifi= , requests > Successfully installed certifi-2026.1.4 charset_normalizer-3.4.4 idna-3.1= 1 requests-2.32.5 urllib3-2.6.3 >=20 > [notice] A new release of pip is available: 23.0.1 -> 25.3 > [notice] To update, run: pip install --upgrade pip > osipovmi@deblndw011x:/tmp/test-venv/create > $ pip list > Package Version > ------------------ -------- > certifi 2026.1.4 > charset-normalizer 3.4.4 > idna 3.11 > pip 23.0.1 > requests 2.32.5 > setuptools 65.5.0 > urllib3 2.6.3 >=20 > [notice] A new release of pip is available: 23.0.1 -> 25.3 > [notice] To update, run: pip install --upgrade pip > osipovmi@deblndw011x:/tmp/test-venv/create > $ python -c 'import requests; print(requests.get("https://dw-eng-rsc.inno= motics.net"))' > Traceback (most recent call last): > File "/tmp/test-venv/create/lib/python3.10/site-packages/urllib3/connec= tionpool.py", line 464, in _make_request > self._validate_conn(conn) > File "/tmp/test-venv/create/lib/python3.10/site-packages/urllib3/connec= tionpool.py", line 1093, in _validate_conn > conn.connect() > File "/tmp/test-venv/create/lib/python3.10/site-packages/urllib3/connec= tion.py", line 796, in connect > sock_and_verified =3D _ssl_wrap_socket_and_match_hostname( > File "/tmp/test-venv/create/lib/python3.10/site-packages/urllib3/connec= tion.py", line 975, in _ssl_wrap_socket_and_match_hostname > ssl_sock =3D ssl_wrap_socket( > File "/tmp/test-venv/create/lib/python3.10/site-packages/urllib3/util/s= sl_.py", line 483, in ssl_wrap_socket > ssl_sock =3D _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_= hostname) > File "/tmp/test-venv/create/lib/python3.10/site-packages/urllib3/util/s= sl_.py", line 527, in _ssl_wrap_socket_impl > return ssl_context.wrap_socket(sock, server_hostname=3Dserver_hostnam= e) > File "/usr/local/lib/python3.10/ssl.py", line 513, in wrap_socket > return self.sslsocket_class._create( > File "/usr/local/lib/python3.10/ssl.py", line 1104, in _create > self.do_handshake() > File "/usr/local/lib/python3.10/ssl.py", line 1375, in do_handshake > self._sslobj.do_handshake() > ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificat= e verify failed: unable to get local issuer certificate (_ssl.c:1017) >=20 > During handling of the above exception, another exception occurred: >=20 > Traceback (most recent call last): > File "/tmp/test-venv/create/lib/python3.10/site-packages/urllib3/connec= tionpool.py", line 787, in urlopen > response =3D self._make_request( > File "/tmp/test-venv/create/lib/python3.10/site-packages/urllib3/connec= tionpool.py", line 488, in _make_request > raise new_e > urllib3.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate= verify failed: unable to get local issuer certificate (_ssl.c:1017) >=20 > The above exception was the direct cause of the following exception: >=20 > Traceback (most recent call last): > File "/tmp/test-venv/create/lib/python3.10/site-packages/requests/adapt= ers.py", line 644, in send > resp =3D conn.urlopen( > File "/tmp/test-venv/create/lib/python3.10/site-packages/urllib3/connec= tionpool.py", line 841, in urlopen > retries =3D retries.increment( > File "/tmp/test-venv/create/lib/python3.10/site-packages/urllib3/util/r= etry.py", line 535, in increment > raise MaxRetryError(_pool, url, reason) from reason # type: ignore[a= rg-type] > urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host=3D'dw-eng-rsc.= innomotics.net', port=3D443): Max retries exceeded with url: / (Caused by S= SLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certi= ficate verify failed: unable to get local issuer certificate (_ssl.c:1017)'= ))) >=20 > During handling of the above exception, another exception occurred: >=20 > Traceback (most recent call last): > File "", line 1, in > File "/tmp/test-venv/create/lib/python3.10/site-packages/requests/api.p= y", line 73, in get > return request("get", url, params=3Dparams, **kwargs) > File "/tmp/test-venv/create/lib/python3.10/site-packages/requests/api.p= y", line 59, in request > return session.request(method=3Dmethod, url=3Durl, **kwargs) > File "/tmp/test-venv/create/lib/python3.10/site-packages/requests/sessi= ons.py", line 589, in request > resp =3D self.send(prep, **send_kwargs) > File "/tmp/test-venv/create/lib/python3.10/site-packages/requests/sessi= ons.py", line 703, in send > r =3D adapter.send(request, **kwargs) > File "/tmp/test-venv/create/lib/python3.10/site-packages/requests/adapt= ers.py", line 675, in send > raise SSLError(e, request=3Drequest) > requests.exceptions.SSLError: HTTPSConnectionPool(host=3D'dw-eng-rsc.inno= motics.net', port=3D443): Max retries exceeded with url: / (Caused by SSLEr= ror(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certifica= te verify failed: unable to get local issuer certificate (_ssl.c:1017)'))) > osipovmi@deblndw011x:/tmp/test-venv/create > $ pip install truststore > Collecting truststore > Downloading truststore-0.10.4-py3-none-any.whl (18 kB) > Installing collected packages: truststore > Successfully installed truststore-0.10.4 >=20 > [notice] A new release of pip is available: 23.0.1 -> 25.3 > [notice] To update, run: pip install --upgrade pip > osipovmi@deblndw011x:/tmp/test-venv/create > $ pip list > Package Version > ------------------ -------- > certifi 2026.1.4 > charset-normalizer 3.4.4 > idna 3.11 > pip 23.0.1 > requests 2.32.5 > setuptools 65.5.0 > truststore 0.10.4 > urllib3 2.6.3 >=20 > [notice] A new release of pip is available: 23.0.1 -> 25.3 > [notice] To update, run: pip install --upgrade pip > osipovmi@deblndw011x:/tmp/test-venv/create > $ python -c 'import truststore; import requests; truststore.inject_into_s= sl(); print(requests.get("https://dw-eng-rsc.innomotics.net"))' > >=20 [1] https://github.com/tiran/certifi-system-store --=20 You are receiving this mail because: You are the assignee for the bug. You are on the CC list for the bug.=