How to Fix macOS Python SSL Certificate Verify Failed

In this tutorial, you'll learn about How to Fix macOS Python SSL Certificate Verify Failed. We cover key concepts, practical examples, and best practices.

The Problem

You make an HTTPS request in Python and get:

urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED]
certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)>

Or:

requests.exceptions.SSLError: HTTPSConnectionPool: Max retries exceeded
with url: Caused by SSLError(SSLCertVerificationError)

The system Python cannot find the root certificate bundle, or the installed Python version has a broken certificate chain.

Quick Fix

Step 1: Install Python via Homebrew (recommended)

brew install python@3.11

The Homebrew version of Python includes the correct certificate bundle.

Step 2: Run the Install Certificates command

For Python installed from python.org:

/Applications/Python\ 3.11/Install\ Certificates.command

This runs a script that updates the certifi package and links the system root certificates.

Step 3: Install or update certifi

pip3 install --upgrade certifi

Then verify:

python3 -c "import certifi; print(certifi.where())"

Expected: a path to the certificates bundle file.

Step 4: Set SSL_CERT_FILE environment variable

export SSL_CERT_FILE=$(python3 -m certifi)

Add to ~/.zshrc for persistence:

echo 'export SSL_CERT_FILE=$(python3 -m certifi)' >> ~/.zshrc

Step 5: Verify the SSL connection

python3 -c "
import urllib.request
response = urllib.request.urlopen('https://example.com')
print(response.status)
"

Expected: 200

Step 6: Disable certificate verification (development only)

import ssl
import urllib.request

# Development only -- never in production
ssl_context = ssl.create_default_context()
ssl_context.check_hostname = False
ssl_context.verify_mode = ssl.CERT_NONE

response = urllib.request.urlopen('https://example.com', context=ssl_context)

Step 7: Install OpenSSL and link certificates

brew install openssl

Then set the certificate path:

export SSL_CERT_FILE=/opt/homebrew/etc/openssl@3/cert.pem

Step 8: Check Python's compiled SSL path

python3 -c "import ssl; print(ssl.get_default_verify_paths())"

If openssl_capath or openssl_cafile point to non-existent files, the certificate chain is broken.

Prevention

• Use Homebrew-installed Python instead of the system Python.
• Run pip install --upgrade certifi after every Python upgrade.
• Set SSL_CERT_FILE in your shell profile.

Common Mistakes with python ssl

1. Overlapping type class instances that cause GHC to reject the program with ambiguous dispatch errors
2. Non-exhaustive pattern matches that compile with warnings then crash at runtime
3. Misunderstanding that String is [Char] with poor performance for large text operations

These mistakes appear frequently in real-world MACOS code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ

DodaTech Tool Reference

Doda Browser's Security Analyzer validates SSL certificate chains and can generate a Python-compatible certificates bundle from the macOS Keychain.