["python","ssl","debian","python-requests","debian-based"]
Python Requests - How to use system ca-certificates (debian/ubuntu)?

I've installed a self-signed root ca cert into debian's /usr/share/ca-certificates/local and installed them with sudo dpkg-reconfigure ca-certificates. At this point true | gnutls-cli mysite.local is happy, and true | openssl s_client -connect mysite.local:443 is happy, but python2 and python3 requests module insists it is not happy with the cert. python2: Traceback (most recent call last): File "<string>", line 1, in <module> File "/usr/local/lib/python2.7/site-packages/requests/api.py", line 70, in get return request('get', url, params=params, **kwargs) File "/usr/local/lib/python2.7/site-packages/requests/api.py", line 56, in request return session.request(method=method, url=url, **kwargs) File "/usr/local/lib/python2.7/site-packages/requests/sessions.py", line 488, in request resp = self.send(prep, **send_kwargs) File "/usr/local/lib/python2.7/site-packages/requests/sessions.py", line 609, in send r = adapter.send(request, **kwargs) File "/usr/local/lib/python2.7/site-packages/requests/adapters.py", line 497, in send raise SSLError(e, request=request) requests.exceptions.SSLError: ("bad handshake: Error([('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')],)",) python3 Traceback (most recent call last): File "<string>", line 1, in <module> File "/usr/local/bin/python3.5/site-packages/requests/api.py", line 70, in get return request('get', url, params=params, **kwargs) File "/usr/local/bin/python3.5/site-packages/requests/api.py", line 56, in request return session.request(method=method, url=url, **kwargs) File "/usr/local/bin/python3.5/site-packages/requests/sessions.py", line 488, in request resp = self.send(prep, **send_kwargs) File "/usr/local/bin/python3.5/site-packages/requests/sessions.py", line 609, in send r = adapter.send(request, **kwargs) File "/usr/local/bin/python3.5/site-packages/requests/adapters.py", line 497, in send raise SSLError(e, request=request) requests.exceptions.SSLError: ("bad handshake: Error([('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')],)",) Why does python ignore the system ca-certificates bundle, and how do I integrate it?
From https://stackoverflow.com/a/33717517/1695680 To make python requests use the system ca-certificates bundle, it needs to be told to use it over its own embedded bundle export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt Requests embeds its bundles here, for reference: /usr/local/lib/python2.7/site-packages/requests/cacert.pem /usr/lib/python3/dist-packages/requests/cacert.pem Or in newer versions use additional package to obtain certificates from: https://github.com/certifi/python-certifi To verify from which file certificates are loaded, you can try: Python 3.8.5 (default, Jul 28 2020, 12:59:40) >>> import certifi >>> certifi.where() '/etc/ssl/certs/ca-certificates.crt'