这是 SSLError using requests for python 的跟进:

我刚刚在 Mac OSX 10.8.5 上安装了 requests。我第一次尝试执行 requests.get 时因缺少证书而失败:

SSLError:[Errno 1] _ssl.c:504:错误:14090086:SSL 例程:SSL3_GET_SERVER_CERTIFICATE:证书验证失败

• 上面的线程说要查找 /Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/re‌ quests/cacert.pem但实际上我什至没有 .../site-packages/requests 目录。我不清楚这是否应该由安装添加(我使用了 pip)

• 其他线程和requests 文档说要安装certifi，所以我做到了。但是现在我得到了一个不同的错误:

  python -c 'import requests; requests.get("https://api.github.com/events")'    /usr/lib/anaconda/lib/python2.7/site-packages/requests/packages/urllib3/util/ssl_.py:90: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning.
    InsecurePlatformWarning
  Traceback (most recent call last):
  ...
    File "/usr/lib/anaconda/lib/python2.7/site-packages/requests/adapters.py", line 431, in send
      raise SSLError(e, request=request)
  requests.exceptions.SSLError: [Errno 1] _ssl.c:504: error:0D0890A1:asn1 encoding routines:ASN1_verify:unknown message digest algorithm
  

谢谢!

最佳答案

请注意，您正在使用 HTTPS。如 Requests manual 中所述

To check a host’s SSL certificate, you can use the verify argument [...] By default, verify is set to True

这里有几种方法可以解决这个问题:

更新 OpenSSL(可能会解决您的问题)

取自here :

If you encounter one of the following errors:

error:0D0890A1:asn1 encoding routines:ASN1_verify:unknown message digest algorithm
error:0D0C50A1:asn1 encoding routines:ASN1_item_verify:unknown message digest algorithm
The software you are using might be compiled with a version too old of OpenSSL that does not take certificates signed with sha256WithRSAEncryption into account.

It requires at least OpenSSL 0.9.8o for a total management of SHA256. OpenSSl 0.9.7m only assures a partial management, for server mode only.

检查你的openssl版本

openssl version
OpenSSL 1.0.1k-fips 8 Jan 2015

如果您的版本小于 OpenSSL0.9.8o，则必须更新其版本 (OS X):

brew update
brew install openssl
brew link --force openssl

如果还是不行，试试这个:

brew uninstall openssl
rm -rf /usr/local/openssl
brew install openssl

• 在 OS X 10.10.3 之前安装的 openssl 存在问题，重新安装可以解决问题
• 这些命令行将卸载 openssl，从您的硬盘中删除它的文件夹并重新安装(更新版本)

安装证书

取自here

By default Requests bundles a set of root CAs that it trusts, sourced from the Mozilla trust store. However, these are only updated once for each Requests version. This means that if you pin a Requests version your certificates can become extremely out of date.

From Requests version 2.4.0 onwards, Requests will attempt to use certificates from certifi if it is present on the system. This allows for users to update their trusted certificates without having to change the code that runs on their system.

For the sake of security we recommend upgrading certifi frequently!

换句话说，如果你有 Request 2.4.0 或更新版本，请尝试安装 certifi:

pip install certifi

希望这能解决问题。

使用不同版本的OpenSSL和Requests

使用 Google 进行调查，我发现 Python 2 中的 OpenSSL 存在问题:

• https://github.com/docker/docker-py/issues/465#issuecomment-76520363
• https://github.com/Homebrew/homebrew/issues/38226
• https://github.com/docker/compose/issues/1484

但是，我使用的是 Python 2.7.6、Requests 2.2.1 和 OpenSSL 1.0.1f 6 Jan 2014，一切运行正常.

通过证书

在其他情况下，如果主机的证书是由您签署的，您可能需要告诉 requests.get 证书文件的路径。

requests.get("https://api.github.com/events", verify=True, cert=['/path/to/my/ca.crt'])

将验证参数设置为 False(不推荐!)

如果您想避免证书验证，您必须将 verify=False 传递给 request.get 方法。

python -c 'import requests; requests.get("https://api.github.com/events", verify=False)'

或来自 script.py 文件:

import requests
res = requests.get("https://api.github.com/events", verify=False)
print res

终端:

$ python script.py
<Response [200]>

重要:非常糟糕的主意；你可以是MITM受到攻击，这是一个严重的安全漏洞。

关于Python 请求抛出 SSL 错误，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/30830901/