GeezerVison

When accessing external HTTPS sites using requests with pip-system-certs and/or defined cacert with the entire certificate path included the following error appears in all versions of 3.13:
r = threatSession.get(baseURL + "/auth/new", headers=headers) #, headers = {"User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"})
File "C:\Program Files\Python313\Lib\site-packages\requests\sessions.py", line 602, in get
return self.request("GET", url, **kwargs)
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^
File "C:\Program Files\Python313\Lib\site-packages\requests\sessions.py", line 589, in request
resp = self.send(prep, **send_kwargs)
File "C:\Program Files\Python313\Lib\site-packages\requests\sessions.py", line 703, in send
r = adapter.send(request, **kwargs)
File "C:\Program Files\Python313\Lib\site-packages\requests\adapters.py", line 698, in send
raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='threatinsight.proofpoint.com', port=443): Max retries exceeded with url: /auth/new (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1020)')))

This is working on versions <=3.12.10

CPython versions tested on:

3.13.0, 3.13.1, 3.13.2, 3.13.3, 3.13.4

Operating systems tested on:

Windows 11

Reacted by jam-re

Activity

DonNeelin
added
type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error
on Jun 11, 2025
ZeroIntensity
added
topic-SSL
on Jun 11, 2025
ZeroIntensity commented on Jun 11, 2025
ZeroIntensity
on Jun 11, 2025
Member
More actions
Would you mind reporting this to requests first? There's a chance that their internal usage of ssl is messed up. If it is a bug on our end, they'll come up with a pure-stdlib reproducer and come back to us.
Reacted by Zachary Ware
ZeroIntensity
added
pendingThe issue will be closed if no feedback is providedThe issue will be closed if no feedback is provided
on Jun 11, 2025
bengaywins commented on Jun 26, 2025
bengaywins
on Jun 26, 2025
More actions
@ZeroIntensity the reporter did that and the requests response shows it's not there. Any idea on a possible fix here? It's impacting some downstream things my team uses (that Jenkins consumes in their helm chart) and has broken things.
ZeroIntensity commented on Jun 26, 2025
ZeroIntensity
on Jun 26, 2025
Member
More actions
No clue, I hadn't seen that requests had isolated it down to urllib3. It's probably a bug with OpenSSL. I'll investigate this further sometime today.
Reacted by Ben Gray
bengaywins commented on Jul 2, 2025
bengaywins
on Jul 2, 2025
More actions
@ZeroIntensity were you able to find anything?
ZeroIntensity commented on Jul 3, 2025
ZeroIntensity
on Jul 3, 2025
Member
More actions
No, sorry, I couldn't reproduce it.
bengaywins commented on Jul 3, 2025
bengaywins
on Jul 3, 2025
More actions
Any suggestions on how we can narrow this down under the circumstances?
ZeroIntensity commented on Jul 3, 2025
ZeroIntensity
on Jul 3, 2025
Member
More actions
Do you have a URL that reproduces the bug? That would help me investigate.
bengaywins commented on Jul 3, 2025
bengaywins
on Jul 3, 2025
More actions
I don't specifically have a URL, but using https://github.com/kiwigrid/k8s-sidecar in Jenkins (it's contained in the Jenkins helm chart) is how I discovered this problem at all. And Grafana is experiencing the same issue. I don't honestly have a very simple repro case, and I apologize for that, but the linked requests issue definitely has a repro.

ZeroIntensity commented on Jul 3, 2025

ZeroIntensity

on Jul 3, 2025

Member

More actions

Yeah, I couldn't reproduce this using the snippet from requests.

If you can reproduce it on your end, please try this C code:

#include <stdio.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/bio.h>

#define HOST "threatinsight.proofpoint.com"
#define PORT "443"

void
ssl_perror(const char *call)
{
    int error = ERR_get_error();
    const char *message = ERR_error_string(error, NULL);
    printf("%s: %s\n", call, message);
    abort();
}

int
main()
{
    SSL_library_init();

    SSL_CTX *ctx = SSL_CTX_new(SSLv23_client_method());
    if (ctx == NULL) {
        ssl_perror("SSL_CTX_new");
    }

    BIO *bio = BIO_new_ssl_connect(ctx);
    if (bio == NULL) {
        ssl_perror("BIO_new_ssl_connect");
    }
    BIO_set_conn_hostname(bio, HOST ":" PORT);

    if (BIO_do_connect(bio) <= 0) {
        ssl_perror("BIO_do_connect");
    }

    char* write_buf = "GET / HTTP/1.1\r\n"
                      "Host: " HOST "\r\n"
                      "Connection: close\r\n"
                      "\r\n";

    if (BIO_write(bio, write_buf, strlen(write_buf)) <= 0) {
        ssl_perror("BIO_write");
    }

    int size;
    char buf[1024];

    for (;;) {
        size = BIO_read(bio, buf, 1023);

        if (size < 0) {
            ssl_perror("BIO_read");
        } else if (size == 0) {
            break;
        }

        buf[size] = 0;
        puts(buf);
    }

    BIO_free_all(bio);
    SSL_CTX_free(ctx);

    return 0;
}

If this errors, it's an issue with OpenSSL.

DonNeelin commented on Aug 28, 2025

DonNeelin

on Aug 28, 2025

Author

More actions

Hi All,

I have revisted this and I have found some interesting behaviour...

I exported the certificate path from Windows cert store, converted the pb7 into pem
I tested the pem directly with openssl 3.5.0 and did not receive any errors:

.\openssl.exe s_client -connect threatinsight.proofpoint.com:443 -CAfile NGFW.pem -verify_return_error -showcerts -verify 5
verify depth is 5
Connecting to 67.231.146.8
CONNECTED(00000218)
depth=4 CN=IPCP RCA SHA2
verify return:1
depth=3 CN=IPCP PCA SHA2
verify return:1
depth=2 DC=ca, DC=cpggpc, CN=IPCP SS ICA SHA2
verify return:1
depth=1 CN=NGFW.cpggpc.ca, [email protected]
verify return:1
depth=0 C=US, ST=California, O=Proofpoint, Inc., CN=threatinsight.proofpoint.com
verify return:1
---
Certificate chain
 0 s:C=US, ST=California, O=Proofpoint, Inc., CN=threatinsight.proofpoint.com
   i:CN=NGFW.cpggpc.ca, [email protected]
   a:PKEY: RSA, 4096 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Sep 26 00:00:00 2024 GMT; NotAfter: Sep 26 23:59:59 2025 GMT
-----BEGIN CERTIFICATE-----
MIIFWDCCBECgAwIBAgIRdvCkOpQtKxk4MEH63xk18tgwDQYJKoZIhvcNAQELBQAw
TDEXMBUGA1UEAxMOTkdGVy5jcGdncGMuY2ExMTAvBgkqhkiG9w0BCQEWInNlY3Vy
aXR5Lm9wZXJhdGlvbnNAaW5ub3ZhcG9zdC5jb20wHhcNMjQwOTI2MDAwMDAwWhcN
MjUwOTI2MjM1OTU5WjBkMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5p
YTEZMBcGA1UEChMQUHJvb2Zwb2ludCwgSW5jLjElMCMGA1UEAxMcdGhyZWF0aW5z
aWdodC5wcm9vZnBvaW50LmNvbTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
ggIBAMTA8aJgPq3gn2v73IyvxywWtysXBV2T1rjOdiVUdePLd6cvne7PFDkNwa54
n47hLgf5QiOLl8ziPtFpLsi2TUZRB4huxcVOwD3Hcy7/mCyOeybXFf7+xLdPOCG8
1N3rSlEOXIYdM2dmtn6WEL/hfOH/d9LMLwzDk56E7yBE/6zhF6zWjjzIB/nJTS1J
mcfc10IvQhPk1jqnuP3FfInF4Vs7xISl+TnCG3a+kUM+MuN8MmkVirJjS0vHZWz/
lF24er69gGHAONmFCkEeekhlVrGj+ZEnZQHCSOoNkzmPiV3DDbJXwVwLgMe/xEf7
h1b1tklNUwfvgtuxyfI03qDUg3/WWyw8iczeeCZZtGHdduHFRdFl0qKRX1kklCAp
Kq0OBVWLaxxUeNss4HJ/9s+SP05PtbAtuvisYkUIDwWVyaCopzMOQfJKDqzZB3L5
rYrunC0Yt00DPsb9jpgHhXwRDmvVjb7jVzj5njtaJ0Ni24x/uy90P34t/fkhHxuz
yll5G6UWokanmQeVqFzswnSYsjftpFaokfCQveigj+U+uBqQMzR5huc1tX3BAtgE
JSNUm4oNpCBfu6/mMYXqGhXoAsym9JiZkLGLvkBR22IQYS9wqsLUYer4BN12HOY8
l110D135n7NqKDWDA2jJ3dHk+RBgHY/ZAlc/xlAQXDsaTr/FAgMBAAGjggEbMIIB
FzAdBgNVHQ4EFgQU6lsNuC6QwMeqM+CZf+AIm9hBcMswDgYDVR0PAQH/BAQDAgWg
MAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMIG4
BgNVHREEgbAwga2CHHRocmVhdGluc2lnaHQucHJvb2Zwb2ludC5jb22CImFscGhh
LXRocmVhdGluc2lnaHQucHJvb2Zwb2ludC5jb22CEm50eC5wcm9vZnBvaW50LmNv
bYIZdGFwLWFwaS12Mi5wcm9vZnBvaW50LmNvbYIWdGFwLWFwaS5wcm9vZnBvaW50
LmNvbYIidHJpYWwtdGhyZWF0aW5zaWdodC5wcm9vZnBvaW50LmNvbTANBgkqhkiG
9w0BAQsFAAOCAQEAkvjLB/zT2E8sjyDaCruL3wNGmgkk9p+UZtsJisF75mHjk118
CL6jOagXZm+kzelcYMFtwmmTV3lAAxSOPviTChOHJGkKIo8tx6vunxC8qmi8sZ0F
UNSCXJ30EtVQAK1d278q/rL7Px9Dp7ZEyU674Mqe3mbE+PfVv+U5PqS0vmAaqVZB
15RIQH7aFejfcP4e8LPrHNamcXazWZE7LGU93q00YGplkaILSvpC8TWH4P79Phk6
PzY7pJ/kLXK+HArfy2rOh+rarZnxyygRdnA7x5E/XjqlcPNhlpiFYLDRlma3bTlR
CvhQS267av+pcuaKkOVzzCDBvHQhAFARcX6v2Q==
-----END CERTIFICATE-----
 1 s:CN=NGFW.cpggpc.ca, [email protected]
   i:DC=ca, DC=cpggpc, CN=IPCP SS ICA SHA2
   a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Mar 31 23:01:37 2024 GMT; NotAfter: Jan  7 15:45:17 2027 GMT
-----BEGIN CERTIFICATE-----
MIIGDTCCBPWgAwIBAgITfAAKuT+d3psFGHu7xwAAAAq5PzANBgkqhkiG9w0BAQsF
ADBHMRIwEAYKCZImiZPyLGQBGRYCY2ExFjAUBgoJkiaJk/IsZAEZFgZjcGdncGMx
GTAXBgNVBAMTEElQQ1AgU1MgSUNBIFNIQTIwHhcNMjQwMzMxMjMwMTM3WhcNMjcw
MTA3MTU0NTE3WjBMMRcwFQYDVQQDEw5OR0ZXLmNwZ2dwYy5jYTExMC8GCSqGSIb3
DQEJARYic2VjdXJpdHkub3BlcmF0aW9uc0Bpbm5vdmFwb3N0LmNvbTCCASIwDQYJ
KoZIhvcNAQEBBQADggEPADCCAQoCggEBAL6XWvkwH+3quiyafZ3o5FXIpoiNgBw8
SiXkuLyWno1jYf0EZYkry3fZIeMemmlatkdJ9Lu6G6oiBAU8z6hYxMqBUfv43pFq
rrvEqvtO25o54R94wBEPiILWgYeHF+e2hWS1luRdHZ+KCn/xXYhguZKD6jyv1kUP
WGcLCiIV/Amw/Gkvtk5L6+rWylQcRYxfktaehDiFVj6DCYmvFrh1AMRVABLVFZ8M
JL0oLPD+98L4IOzt+zGXv72RyEpUigViZj9jNVJLepmWddWYHmUzQa+gecP9A2DQ
Rcvdj2pY7Vs6hTcSyGdZ4yn0hyuzS85CN8qLXlAY++AFnomUes2hcB0CAwEAAaOC
AuswggLnMB0GA1UdDgQWBBRHLcrUVB/XymsPq0VZj7nYWPf4rTAfBgNVHSMEGDAW
gBSxoDgnKYEe3SWFEzmyhzkwSOsM0jCCASMGA1UdHwSCARowggEWMIIBEqCCAQ6g
ggEKhoHAbGRhcDovLy9DTj1JUENQJTIwU1MlMjBJQ0ElMjBTSEEyLENOPVNTLUlQ
Q1AtU0hBMixDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2Vy
dmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1jcGdncGMsREM9Y2E/Y2VydGlmaWNh
dGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlv
blBvaW50hkVodHRwOi8vY3Jsd2Vic2VydmVyc3MuY3BnZ3BjLmNhL2NlcnRlbnJv
bGwvSVBDUCUyMFNTJTIwSUNBJTIwU0hBMi5jcmwwggEbBggrBgEFBQcBAQSCAQ0w
ggEJMIGzBggrBgEFBQcwAoaBpmxkYXA6Ly8vQ049SVBDUCUyMFNTJTIwSUNBJTIw
U0hBMixDTj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2Vydmlj
ZXMsQ049Q29uZmlndXJhdGlvbixEQz1jcGdncGMsREM9Y2E/Y0FDZXJ0aWZpY2F0
ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmljYXRpb25BdXRob3JpdHkwUQYIKwYB
BQUHMAKGRWh0dHA6Ly9jcmx3ZWJzZXJ2ZXJzcy5jcGdncGMuY2EvY2VydGVucm9s
bC9JUENQJTIwU1MlMjBJQ0ElMjBTSEEyLmNydDAPBgNVHRMBAf8EBTADAQH/MA4G
A1UdDwEB/wQEAwIBhjA+BgkrBgEEAYI3FQcEMTAvBicrBgEEAYI3FQiGvZxNhNSV
W4SNlSqHyZothqXBXIEfgvz1KoSFjC0CAWQCAQowDQYJKoZIhvcNAQELBQADggEB
AJvYNGWctu7kMtcGcLNDk1oYWNSWt3SPR0ZaCQ33VaM2qlrJW9248ujBRPixFJss
b1Q7RZQHSW6XDhb61nEfytWBG7jxIWuDqmO4rMvPKusV6HgYzgvPIv5OINvIJHy7
+5/XruzCFxG1sHrtBhfZYrt4jGv9aQTiy0gnP98JRgrEzI2hXuFzM1kH6SbpU5vX
BNFNQNIfb3LdmpTM+nJRll6NrJR4HX9hoedfDNL9ayUh4omN00H5pflmiMfHGsbR
WcgluV+lhai/h1diMZSjh+u8naYALn/BiL/baqKyAVuhZ/2zgZiQroAYJ1G0AWLQ
EfEFYwJI3IToGNXO/XeilUI=
-----END CERTIFICATE-----
 2 s:DC=ca, DC=cpggpc, CN=IPCP SS ICA SHA2
   i:CN=IPCP PCA SHA2
   a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Jan  7 15:35:17 2017 GMT; NotAfter: Jan  7 15:45:17 2027 GMT
-----BEGIN CERTIFICATE-----
MIIH2TCCBcGgAwIBAgITVgAAAANUP5lgezHtwAAAAAAAAzANBgkqhkiG9w0BAQsF
ADAYMRYwFAYDVQQDEw1JUENQIFBDQSBTSEEyMB4XDTE3MDEwNzE1MzUxN1oXDTI3
MDEwNzE1NDUxN1owRzESMBAGCgmSJomT8ixkARkWAmNhMRYwFAYKCZImiZPyLGQB
GRYGY3BnZ3BjMRkwFwYDVQQDExBJUENQIFNTIElDQSBTSEEyMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5+4AzV/lzpwUa6V/ENYAYchPzlJL6NL8RsZd
++6ncdK8TbmWtu3SZl1stbGnfPUIwKETmzBJTDkS7aR459h6lIYCa0PjHVAN59Ix
KGdJmcDM2Erda/u9Pq/uTTRX008+pB9N60HvDrgIv5JbptJ9Cd5YwyjNnD8eNMaV
5TyjJXSBtS4PILYuQFmYQCWdJZvRL55WwgjSN3idJRdBpC/cO+VQPqOL07qwD03I
H+/DxDemXP+YPvuwE7OxtrK3uhfTPtCe7hW4AaD6YiS7MG4xndB+HbFQPXWzpEj/
fs1YUVG/jvYUoGhxMCFPmetuNOBjmP+7xezCuHRBfToK+Xz0KQIDAQABo4ID6zCC
A+cwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFLGgOCcpgR7dJYUTObKHOTBI
6wzSMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMAsGA1UdDwQEAwIBhjAPBgNV
HRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFAmxzjij0IfskEZyGO7926dAp/2yMIIB
owYDVR0fBIIBmjCCAZYwggGSoIIBjqCCAYqGgb1sZGFwOi8vL0NOPUlQQ1AlMjBQ
Q0ElMjBTSEEyLENOPUlQLVctMDI2ODgtQzVCLENOPUNEUCxDTj1QdWJsaWMlMjBL
ZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPWNw
Z2dwYyxEQz1jYT9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0
Q2xhc3M9Y1JMRGlzdHJpYnV0aW9uUG9pbnSGQGh0dHA6Ly9DUkx3ZWJzZXJ2ZXJT
Uy5jcGdncGMuY2EvQ2VydEVucm9sbC9JUENQJTIwUENBJTIwU0hBMi5jcmyGQ2h0
dHA6Ly9DUkx3ZWJzZXJ2ZXJIUy5ocy1jcGdncGMuY2EvQ2VydEVucm9sbC9JUENQ
JTIwUENBJTIwU0hBMi5jcmyGQWh0dHA6Ly9DUkx3ZWJzZXJ2ZXJFVUMuY3BnZ3Bj
LmNhL0NlcnRFbnJvbGwvSVBDUCUyMFBDQSUyMFNIQTIuY3JsMIIBsQYIKwYBBQUH
AQEEggGjMIIBnzCBrgYIKwYBBQUHMAKGgaFsZGFwOi8vL0NOPUlQQ1AlMjBQQ0El
MjBTSEEyLENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2
aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPWNwZ2dwYyxEQz1jYT9jQUNlcnRpZmlj
YXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTBMBggr
BgEFBQcwAoZAaHR0cDovL0NSTHdlYnNlcnZlclNTLmNwZ2dwYy5jYS9DZXJ0RW5y
b2xsL0lQQ1AlMjBQQ0ElMjBTSEEyLmNydDBPBggrBgEFBQcwAoZDaHR0cDovL0NS
THdlYnNlcnZlckhTLmhzLWNwZ2dwYy5jYS9DZXJ0RW5yb2xsL0lQQ1AlMjBQQ0El
MjBTSEEyLmNydDBNBggrBgEFBQcwAoZBaHR0cDovL0NSTHdlYnNlcnZlckVVQy5j
cGdncGMuY2EvQ2VydEVucm9sbC9JUENQJTIwUENBJTIwU0hBMi5jcnQwDQYJKoZI
hvcNAQELBQADggIBAHCQj65A0jebnVgzuLMEXwHCo/jtYiboqC9c76r5kIWn1A2s
I054+BIZrul96QJEkD9Xa1HNevPWK8nV68z21RTRvj50zMpPkJeUaOoFULTwVJ15
jf2DmzQnTcyUK+6tREM/rmrQiF1SPuImr2I6yYsyib+UinNZUVNXoGJCEz8E1PBf
KVXGmqK7ssmomGtElAPN5Cafg1Jw7G2ROo0FYTLI3/5qQraC4jBpW7HQQkPHYPc9
xRoSYiaxIns1nhfslZGdbJwMZGrZYcxpSBe89M+2Oc6iGgpeee9dOJdIKSKVA8yG
Y7j8fCc433a0DHKerdfxsx9cyk1duwjQu6JRiQP37c99wproXg6WTbh8ob37hFsU
9WhNYX9pDO03rjGbG6pfuCXlVQlMdYDVB9IfYGGyglphb/PCqCUKNRsx0biMRxUB
fCuxVlBfa1sIJf0mzdMu8UTuFX+keUUZtE8D0nx3LsjEhn91id9v0XKcxeQx10Y+
0lfwSc/gGvvCT5dqza87hxWqcKman0xI79c3btvd7k7uBth9hqKpXsoDjkDFTVLX
ZANSgH3+Ey7V92C2WldwTr6M7bRLmP99I4rBBrlX5InpX2h9e8pdgSvj1lFo90Ty
5XzhmVRjwkz13DOuKEkhFyZ1ToJpITIjnYkJ2ISOenvaZPfdgItG52OIyDGu
-----END CERTIFICATE-----
 3 s:CN=IPCP PCA SHA2
   i:CN=IPCP RCA SHA2
   a:PKEY: RSA, 4096 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Dec 29 19:37:23 2016 GMT; NotAfter: Dec 29 17:16:42 2036 GMT
-----BEGIN CERTIFICATE-----
MIIIljCCBn6gAwIBAgITawAAAAKhvaIPc1AZpQAAAAAAAjANBgkqhkiG9w0BAQsF
ADAYMRYwFAYDVQQDEw1JUENQIFJDQSBTSEEyMB4XDTE2MTIyOTE5MzcyM1oXDTM2
MTIyOTE3MTY0MlowGDEWMBQGA1UEAxMNSVBDUCBQQ0EgU0hBMjCCAiIwDQYJKoZI
hvcNAQEBBQADggIPADCCAgoCggIBAM11F59tqP3PXXwiJEF3wfxIp+V45+BRr7Fb
SbZPC1KDQyz3Oy1UU057RAHvYYeLP2Yi0NTEy/PtfwV3OPMgislvi352LXDQsQ1r
yYPUKD0jZldms4DlT0yVUxQjQCCE/VZCXOGGD8dATbrci0tNU1lSdFzkTwOw2JTV
/w7WrTDnSiRjIBNyCXsoSqzYra5L6ADzblAl+fcR7Xllg3Ni4q+GVl1Ck9Wj2XT1
bQdVg+K4oi6zVbh1SJQoOV+ELBlBALaValAPF/EsnP6xK903PsSO5rHassok/RTT
afsCTKV1424ire2LQyHwaLmWmCF6OiNlWMQpDJ3WjQ/AQo/vUvA5O2ewp1H6qq8t
nXwj/by+11Y8rHAvGxmWcqXpLsPpW4sx9MbvdyY1Jmu3bQSSCPLPD92QWHxabngF
IdD0z2QnndQdy7do5/mVL/Zf2u7Vfnou517zDpbfgxD2KH5CxRi1vyGkH0EvpKLr
sneTLe7dLLFJrfc2zWCGAsSCtu6uilKmL0dbjWTxGQ9MslPM/YBSSQ7ir1T0/g4/
b5qbbBxtlSOHQGjtD+U1i8bPSmv+xwGh26j3RJ3K7KcHkDbm6roqIEyOIyBv6CWI
N2a8Uej3vWYFx0Ed7qg0GGDa2shVt4KTd7IAYZSmnMU1a5Lhwjy50rLysn2emWyB
nvRh3QOlAgMBAAGjggPXMIID0zAQBgkrBgEEAYI3FQEEAwIBADAdBgNVHQ4EFgQU
CbHOOKPQh+yQRnIY7v3bp0Cn/bIwGQYJKwYBBAGCNxQCBAweCgBTAHUAYgBDAEEw
CwYDVR0PBAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAULHLycLS+
qwWJJy0SKMtr2fLUBnMwggGZBgNVHR8EggGQMIIBjDCCAYigggGEoIIBgIaBs2xk
YXA6Ly8vQ049SVBDUCUyMFJDQSUyMFNIQTIsQ049SVAtVy0wMjY4Ny1DNUIsQ049
Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLERDPVVu
YXZhaWxhYmxlQ29uZmlnRE4/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNl
P29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50hkBodHRwOi8vQ1JMd2Vi
c2VydmVyU1MuY3BnZ3BjLmNhL0NlcnRFbnJvbGwvSVBDUCUyMFJDQSUyMFNIQTIu
Y3JshkNodHRwOi8vQ1JMd2Vic2VydmVySFMuaHMtY3BnZ3BjLmNhL0NlcnRFbnJv
bGwvSVBDUCUyMFJDQSUyMFNIQTIuY3JshkFodHRwOi8vQ1JMd2Vic2VydmVyRVVD
LmNwZ2dwYy5jYS9DZXJ0RW5yb2xsL0lQQ1AlMjBSQ0ElMjBTSEEyLmNybDCCAacG
CCsGAQUFBwEBBIIBmTCCAZUwgaQGCCsGAQUFBzAChoGXbGRhcDovLy9DTj1JUENQ
JTIwUkNBJTIwU0hBMixDTj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMs
Q049U2VydmljZXMsREM9VW5hdmFpbGFibGVDb25maWdETj9jQUNlcnRpZmljYXRl
P2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTBMBggrBgEF
BQcwAoZAaHR0cDovL0NSTHdlYnNlcnZlclNTLmNwZ2dwYy5jYS9DZXJ0RW5yb2xs
L0lQQ1AlMjBSQ0ElMjBTSEEyLmNydDBPBggrBgEFBQcwAoZDaHR0cDovL0NSTHdl
YnNlcnZlckhTLmhzLWNwZ2dwYy5jYS9DZXJ0RW5yb2xsL0lQQ1AlMjBSQ0ElMjBT
SEEyLmNydDBNBggrBgEFBQcwAoZBaHR0cDovL0NSTHdlYnNlcnZlckVVQy5jcGdn
cGMuY2EvQ2VydEVucm9sbC9JUENQJTIwUkNBJTIwU0hBMi5jcnQwDQYJKoZIhvcN
AQELBQADggIBAGIHSsZCCzk7LzjdhQXtGjlpGXSmleUuuPR6WwZzoKu3P10reKxZ
BfH9hrAJEZ82Xqsjzix3ohvGDZZxt2c8i4QxFjTIH+0iWh59IEAzrPT1yv7705lO
97uF26cExTCwjttAQPT22ItMmNrSUHPChsbO8AJ2Oa14frpEWLmd/RwMNJsGGuHo
lv41vNwgQeI6S+RKQw4WtPT1ja0rcrFwInELKPx8Il520U+f8VC0HtyNU47WZLUn
NtzcSbLwykBMaZNAiHtlvrnxJe0vCwl6XHrrw/lujuuY/WwWZjRKo0631JpXKVLs
vq40h10R+Gc0KVfsFiQm3/7j1O/wLOls9IY9j616+ajgsoQ5zffWAEoGGDq+3kTb
WRx4fYQ18ceDsy9jr3mpIFpaa42EldkZo2Bc3AMt0Lsf25yPAhOjfo5cXaAQcKlo
Ch6yvUtg81wif3cWvq1pqJz0fYcRAVGA1Vz1ORl2wgsDZLx0d2n4cZZg8Pb51mfP
wdSMGCINqDWAiZFUWODPDcT4h9mNshnVgmlz6baOh5fBvNUBWw/f5R54zn9WxOzV
3kDb3k3vAFfuY1b+lAd+YkK+phBDgdnEkgCFs0uk1hribmm+qhNDOcmqCg4uhxvc
8OXGtEcAQoSCWTFpKgZ08xq9UoUlM2sTn2C2xPlo0sGZ15iz3igzsI5Z
-----END CERTIFICATE-----
 4 s:CN=IPCP RCA SHA2
   i:CN=IPCP RCA SHA2
   a:PKEY: RSA, 4096 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Dec 29 17:12:54 2016 GMT; NotAfter: Dec 29 17:16:42 2036 GMT
-----BEGIN CERTIFICATE-----
MIIFCzCCAvOgAwIBAgIQHQuW3CRY/IRGcBjC1xbPEDANBgkqhkiG9w0BAQsFADAY
MRYwFAYDVQQDEw1JUENQIFJDQSBTSEEyMB4XDTE2MTIyOTE3MTI1NFoXDTM2MTIy
OTE3MTY0MlowGDEWMBQGA1UEAxMNSVBDUCBSQ0EgU0hBMjCCAiIwDQYJKoZIhvcN
AQEBBQADggIPADCCAgoCggIBALjDftA71b52BoPi8onIywZfIDQsuNEaTBopbYi5
dnlLUFrLURCWGOJIz72Up2Wmh0TmoMxky++kj/qx0JJQXGtqAxkSmANRA4C13zdQ
eqN40sMTHow7NP22JF+a8pOGMdleQUsE9SGh1NHKsGNcgI3Xf/61jPRIuoEKntPI
7FW03gC0RA5E9iPvZnJjudPzqgLnDUJhXgiYTbQkgeB/wHoO4S9b5sXhuET1zQfp
Ys+XEO/jw75YH29WXj8N/x4CWhA6vWJBpHpj9xKWSp7B3p4rhhopiRpT6vOsKbnx
l2XOzAD49g9852fNDQnjsjHeBmQnr2AQbzCuQ+6/n5kBVXiJ3F8EgaG9SA6IgUuR
7ViiMLaB28oFppPlY43nsXc7KALHZvHcruy9VC2Iad7uZqADTmwHWgdS1XCsMNtQ
K83v0ujp9NB5zOfII/ZaFKL2KtWWUTLhKnXwzNdDczMzNqDmQUwYBCmrfz455upX
iZZX2w5hWXF+2XjXDicKhAI8FcVCCVvymX5k+CsA2eTsKdGGfC6BOjNL4wyDI9wF
2oLLLAnVYnGCcG/55lwLtVeyl7rKtW474rlmwNISqut/b6gOLqDShe4DTptVuBhe
NXHCIhIJE842azdHUIk7t7yXlD+1sMkm3bi2CefSL471ykQPln5i9ukbLxp/nV19
r0gbAgMBAAGjUTBPMAsGA1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
DgQWBBQscvJwtL6rBYknLRIoy2vZ8tQGczAQBgkrBgEEAYI3FQEEAwIBADANBgkq
hkiG9w0BAQsFAAOCAgEAmmj6S8JQ3ApG/yT8uc/5yMwtq2khkf19bHPfMbm9rTRx
9ywaFu9+GlUMLT9tIrhGKP+hctAuLv8E26irlahoAJxZ33gyWGpT6/1rWIqAr1HV
V1c4kerT1CpWjIxGe6ME2o1z19voatzdZ5FF5tPfiiGs6jrdKQniEMWPlf/Ita+q
fhSdl1d9hcRxOTL9KBPn1x1JfDdHCS5jlCIfBqN4ghrHjosYPRhTPUufyZgAwxLi
v2K0EJMWZdO9/YxWIPZX/HWwvM1ECsK5NxX9fWG2Pb9QqpxWTM8UjGtr5vvsc6T1
W8mCVBDhT+oeq4eM/xR3UETOR63OFFtCX6SR/pMjNhzN9JF0W14V7iSOewUWr4dg
9bLrvFrwtVL7kGcK7ntbhXZvfUXnrrYUSL8MMe/QwY8wwWdlI9y0CuugJ8bRm/mO
t++0+w7MeKYMNVEtnxlCDIMZ29VEZx3CKGK64wuM161wFt3iQfg4CWJnCLlvPe1J
h6GhGgQGCvnjBGw47xx5yphqmI7/7dxQg9C0q7Qoqwl5njryKA5EhTGkN89Czhxe
oW9izKclnUUqk1V8Bx/5FLfX0+LE5AHIwszBBskG5TVpyYKcVZfWdZnU15EEfrnV
1Xv4xs4xQqz1s0kZcfXa+V61fNrdQe+Gq/2SD/YSJiMrNyiRACHN4oAnzXJJ3Ik=
-----END CERTIFICATE-----
---
Server certificate
subject=C=US, ST=California, O=Proofpoint, Inc., CN=threatinsight.proofpoint.com
issuer=CN=NGFW.cpggpc.ca, [email protected]
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: rsa_pss_rsae_sha256
Peer Temp Key: X25519, 253 bits
---
SSL handshake has read 9181 bytes and written 1654 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Protocol: TLSv1.2
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: A69EE04052A582D3BB0753368FDEB0F1AC50586174DEA807FAE92F75080BB253
    Session-ID-ctx:
    Master-Key: 911DE5E83C7F20B3518DC09A3CCDA895227CF88646D39BA1FC5230149B6026F1FDA3C23A7697806FD39D1EB163E83264
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1756300553
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: yes
---
closed

I ran the same pem through my script and received an error:

    r = threatSession.get(baseURL + "/auth/new", headers=headers, verify="./NGFW.pem")
  File "C:\Program Files\Python313\Lib\site-packages\requests\sessions.py", line 602, in get
    return self.request("GET", url, **kwargs)
           ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python313\Lib\site-packages\requests\sessions.py", line 589, in request
    resp = self.send(prep, **send_kwargs)
  File "C:\Program Files\Python313\Lib\site-packages\requests\sessions.py", line 703, in send
    r = adapter.send(request, **kwargs)
  File "C:\Program Files\Python313\Lib\site-packages\requests\adapters.py", line 698, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='threatinsight.proofpoint.com', port=443): Max retries exceeded with url: /auth/new (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032)')))

I ran the above c code and recieved this output:

C:\openssl>main.exe
HTTP/1.1 200 OK
Date: Thu, 28 Aug 2025 01:48:13 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: strict-origin-when-cross-origin
Link: </assets/auth/route_cookie_with_redirect-39cba556439c2e8c6fddb8ae7a57f47b1214fe52b4ef34d7238bc41f7aef1971.js>; rel=preload; as=script; nopush
Server-Timing: traceparent;desc="00-a1fc9340f694cb36bd8b08ac95635ec4-f4e20324cd7840e3-01"
Access-Control-Expose-Headers: Server-Timing
ETag: W/"751e31b2cea3698bb356bd5598ef2ce2"
Cache-Control: max-age=0, private, must-revalidate
Content-Security-Policy: connect-src 'self' https://*.proofpoint.com https://*.proofpoint.us https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-6260036559175680.storage.googleapis.com https://*.signalfx.c
om; default-src 'self' https://*.proofpoint.com https://*.proofpoint.us; font-src data: 'self' https://*.proofpoint.com https://*.proofpoint.us https://fonts.googleapis.com https://fonts.gstatic.com https://*.bootstrapcdn.com; frame-src 'self' https://*.proofpoint.com https://*.proofpoint.us https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-6260036559175680.storage.googleapis.com; img-src blob: data: https://*.proofpoint.com https://*.proofpoint.us https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-6260036559175680.storage.googleapis.com; object-src 'none'; script-src 'self' https://*.proofpoint.com https://*.proofpoint.us https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-6260036559175680.storage.googleapis.com https://*.signalfx.com; style-src blob: 'self' 'unsafe-inline' https://*.proofpoint.com https://*.proofpoint.us https://fonts.googleapis.com https://fonts.gstatic.com https://*.bootstrapcdn.co
m https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-6260036559175680.storage.googleapis.com; worker-src blob: 'self' https://*.proofpoint.com https://*.proofpoint.us
X-Request-Id: 490ed058db56c69c881a7c814bcb4b72
X-Runtime: 0.002703
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

83
<script src="/assets/auth/route_cookie_with_redirect-39cba556439c2e8c6fddb8ae7a57f47b1214fe52b4ef34d7238bc41f7aef1971.js"></script>
0



C:\openssl>

Now for the interesting part... I installed truststore and added the following lines to my code

import truststore
truststore.inject_into_ssl()

The script executed without issue

My conclusion is that there is something in the ssl handling of the .pem file, or the way the file is being passed to openssl, that is causing an issue with the validation. OpenSSL was able to use the pem file without issue.

I am surprised that pip_system_certs is also having an issue, as it is apparently calling truststore itself, but is erroring the same as providing a pem file. Or is this just the same issue in a different form.

DonNeelin commented on Aug 28, 2025

DonNeelin

on Aug 28, 2025

Author

More actions

One last test. I modified the c program to use the pem file with the following code, and the connection was successful.

//    SSL_CTX *ctx = SSL_CTX_new(SSLv23_client_method());
    const SSL_METHOD *method = TLS_client_method();
    SSL_CTX *ctx = SSL_CTX_new(method);
    if (ctx == NULL) {
        ssl_perror("SSL_CTX_new");
    }

// Load the certificate chain from a PEM file
    if (!SSL_CTX_load_verify_locations(ctx, "NGFW.pem", NULL)) {
        ERR_print_errors_fp(stderr);
        return 1;
    } else {
        printf("NGFW.pem loaded...");
    }

ZeroIntensity
removed
pendingThe issue will be closed if no feedback is providedThe issue will be closed if no feedback is provided
on Aug 28, 2025
picnixz
added
extension-modulesC modules in the Modules dirC modules in the Modules dir
on Aug 28, 2025
bengaywins commented on Nov 13, 2025
bengaywins
on Nov 13, 2025
More actions
I know it's been a while, but the cause of this is unrelated to cpython. It's entirely related to the stricter validation of certificates that Python 3.13+ enforce. A full explanation can be found here. Imo, this should be closed as it's not technically a problem here.

Metadata

Assignees

No one assigned

Labels

extension-modulesC modules in the Modules dirC modules in the Modules dirtopic-SSLtype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

SSL: CERTIFICATE_VERIFY_FAILED when using custom root CA in Windows #135408

Description

Bug report

Bug description:

CPython versions tested on:

Operating systems tested on:

Activity

ZeroIntensity commented on Jun 11, 2025

bengaywins commented on Jun 26, 2025

ZeroIntensity commented on Jun 26, 2025

bengaywins commented on Jul 2, 2025

ZeroIntensity commented on Jul 3, 2025

bengaywins commented on Jul 3, 2025

ZeroIntensity commented on Jul 3, 2025

bengaywins commented on Jul 3, 2025

ZeroIntensity commented on Jul 3, 2025

DonNeelin commented on Aug 28, 2025

DonNeelin commented on Aug 28, 2025

bengaywins commented on Nov 13, 2025

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions