how do I update root certificates of certifi?

python ssl urllib root-certificate certifi
vishal picture vishal · Dec 18, 2017 · Viewed 21.1k times · Source

I am using certifi python module to verify ssl connections. I looked at the root certificates included in certifi (python2.7/site-packages/certifi/cacert.pem) and some of those certificates have expired. How do I update those certificates? I tried updating certifi package using pip but that only updates the package and not the root CA files.

Answer

ivan_pozdeev picture ivan_pozdeev · Dec 18, 2017

certifi/cacert.pem is, naturally, a part of certifi. Consequently, it's supposed to be updated with the module.

  • You can check if the latest code at https://github.com/certifi/python-certifi has a newer bundle and if it does, install the module directly from there with pip install git+https://github.com/certifi/python-certifi.
  • You can also replace cacert.pem with any other certificate bundle that meets your needs, like the Mozilla root certificate store. Of course, your changes will be lost the next time you update the module.

Related questions

urllib and "SSL: CERTIFICATE_VERIFY_FAILED" Error

I am getting the following error: Exception in thread Thread-3: Traceback (most recent call last): File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/threading.py", line 810, in __bootstrap_inner self.run() File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/threading.…

Read More
Urllib and validation of server certificate

I use python 2.6 and request Facebook API (https). I guess my service could be target of Man In The Middle attacks. I discovered this morning reading again urllib module documentation that : Citation: Warning : When opening HTTPS URLs, it is not …

Read More
Urllib.urlopen() works on SSLv3 urls with Python 2.6.6 on 1 machine, but not with 2.6.7/2.7.2 on another

Spent a good part of a day on this, and I'm realllly at my wit's end. I have 1 machine "A" with Python 2.6.6/2.7.2 installed, and another machine "B" with Python 2.6.7/2.7.2 installed. On machine A, I can get a SSLv3-encrypted website …

Read More