Python请求抛出SSL错误 [英] Python requests throwing SSL errors

查看：558
本文介绍了Python请求抛出SSL错误的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！

问题描述

这是对使用针对python的请求的SSLError的后续操作:

我刚在Mac OSX 10.8.5上安装了requests.我第一次尝试失败的原因是缺少证书:

SSLError: [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

  • 上面的线程说要查找/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/re‌​quests/cacert.pem，但实际上我什至没有.../site-packages/requests目录.对我来说尚不清楚是否应该在安装中添加(我用pip)

  • 更多线程和requests文档说要安装certifi，所以我做到了.但是现在我得到了另一个错误:

    python -c 'import requests; requests.get("https://api.github.com/events")'    /usr/lib/anaconda/lib/python2.7/site-packages/requests/packages/urllib3/util/ssl_.py:90: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning.
  InsecurePlatformWarning
Traceback (most recent call last):
...
  File "/usr/lib/anaconda/lib/python2.7/site-packages/requests/adapters.py", line 431, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: [Errno 1] _ssl.c:504: error:0D0890A1:asn1 encoding routines:ASN1_verify:unknown message digest algorithm

谢谢！

解决方案

请注意，您正在使用HTTPS.如请求手册

要检查主机的SSL证书，可以使用verify参数[...]默认情况下，verify设置为True

以下几种解决方法:

更新OpenSSL(可能会解决您的问题)

来自此处:

如果遇到以下错误之一:

error:0D0890A1:asn1 encoding routines:ASN1_verify:unknown message digest algorithm
error:0D0C50A1:asn1 encoding routines:ASN1_item_verify:unknown message digest algorithm
The software you are using might be compiled with a version too old of OpenSSL that does not take certificates signed with sha256WithRSAEncryption into account.

它至少需要OpenSSL 0.9.8o才能对SHA256进行全面管理. OpenSSl 0.9.7m仅确保对服务器的部分管理 模式.

通过以下方式检查您的openssl版本:

openssl version
OpenSSL 1.0.1k-fips 8 Jan 2015

如果版本小于OpenSSL0.9.8o，则必须更新其版本(OS X):

brew update
brew install openssl
brew link --force openssl

如果这不起作用，请尝试以下方式:

brew uninstall openssl
rm -rf /usr/local/openssl
brew install openssl

  • 在OS X 10.10.3之前安装openssl存在问题，然后重新安装即可解决
  • 这些命令行将卸载openssl，从硬盘上删除其文件夹，然后重新安装(更新版本)

安装certifi

来自此处

默认情况下，请求捆绑了一组它信任的根CA，源于 从Mozilla信任存储中.但是，这些仅更新一次 每个请求版本.这意味着如果您固定请求版本 您的证书可能会变得非常过时.

从请求版本2.4.0开始，请求将尝试使用 来自certifi的证书(如果系统中存在).这允许 用户无需更新即可更新其受信任的证书 更改在其系统上运行的代码.

为了安全起见，我们建议您经常升级证书！

换句话说，如果您具有Request 2.4.0或更高版本，请尝试安装certifi:

pip install certifi

希望这可以解决问题.

使用不同版本的OpenSSL和请求

在使用Google进行调查时，我发现Python 2中的OpenSSL存在问题.

但是，我正在使用Python 2.7.6，Requests 2.2.1和OpenSSL 1.0.1f 6 Jan 2014，并且一切正常运行.

通过证书

在其他情况下，如果主机的证书是由您签名的，则可能需要告诉requests.get证书文件的路径.

requests.get("https://api.github.com/events", verify=True, cert=['/path/to/my/ca.crt'])

将verify参数设置为False(不推荐！)

如果要避免证书验证，则必须将verify=False传递给request.get方法.

python -c 'import requests; requests.get("https://api.github.com/events", verify=False)'

或来自script.py文件:

import requests
res = requests.get("https://api.github.com/events", verify=False)
print res

终端:

$ python script.py
<Response [200]>

重要 :非常糟糕的主意；您可能受到 MITM 的攻击，这是一个严重的安全漏洞.

This is a followup to SSLError using requests for python:

I have just installed requests on a Mac OSX 10.8.5. My first attempt at doing requests.get failed on missing certificate:

SSLError: [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

  • The thread above says to look for /Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/re‌​quests/cacert.pem but actually I don't even have a .../site-packages/requests directory. It's not clear to me if this should have been added by the installation (I used pip)

  • Further threads and the requests docs say to install certifi, so I did. But now I get a different error:

    python -c 'import requests; requests.get("https://api.github.com/events")'    /usr/lib/anaconda/lib/python2.7/site-packages/requests/packages/urllib3/util/ssl_.py:90: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning.
  InsecurePlatformWarning
Traceback (most recent call last):
...
  File "/usr/lib/anaconda/lib/python2.7/site-packages/requests/adapters.py", line 431, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: [Errno 1] _ssl.c:504: error:0D0890A1:asn1 encoding routines:ASN1_verify:unknown message digest algorithm

Thanks!

解决方案

Notice that you're using HTTPS. As mentioned in the Requests manual

To check a host’s SSL certificate, you can use the verify argument [...] By default, verify is set to True

Here are few ways to fix that:

Update OpenSSL (probably will solve your problem)

Taken from here:

If you encounter one of the following errors:

error:0D0890A1:asn1 encoding routines:ASN1_verify:unknown message digest algorithm
error:0D0C50A1:asn1 encoding routines:ASN1_item_verify:unknown message digest algorithm
The software you are using might be compiled with a version too old of OpenSSL that does not take certificates signed with sha256WithRSAEncryption into account.

It requires at least OpenSSL 0.9.8o for a total management of SHA256. OpenSSl 0.9.7m only assures a partial management, for server mode only.

Check your openssl version by

openssl version
OpenSSL 1.0.1k-fips 8 Jan 2015

If you have a smaller version than OpenSSL0.9.8o, you have to update its version (OS X):

brew update
brew install openssl
brew link --force openssl

If that doesn't work, try this way:

brew uninstall openssl
rm -rf /usr/local/openssl
brew install openssl

  • there's an issue with openssl installed before OS X 10.10.3 and reinstalling it fixes it
  • these command lines will uninstall openssl, remove its folder from your hard-disk and install it again (the updated version)

Install certifi

Taken from here

By default Requests bundles a set of root CAs that it trusts, sourced from the Mozilla trust store. However, these are only updated once for each Requests version. This means that if you pin a Requests version your certificates can become extremely out of date.

From Requests version 2.4.0 onwards, Requests will attempt to use certificates from certifi if it is present on the system. This allows for users to update their trusted certificates without having to change the code that runs on their system.

For the sake of security we recommend upgrading certifi frequently!

In other word, try to install certifi, if you have Request 2.4.0 or newer:

pip install certifi

Hopefully, this will fix the problem.

Use different version of OpenSSL and Requests

Looking into it using Google, I have found that there is a problem with OpenSSL in Python 2:

However, I am using Python 2.7.6, Requests 2.2.1 and OpenSSL 1.0.1f 6 Jan 2014 and everything runs correctly.

Pass the certificate

In other cases, you may need to tell requests.get the path to the certificate file, if the host's certificate was signed by you.

requests.get("https://api.github.com/events", verify=True, cert=['/path/to/my/ca.crt'])

Set the verify argument to False (NOT RECOMMENDED!)

In case you want to avoid the certificate verification, you have to pass verify=False to the request.get method.

python -c 'import requests; requests.get("https://api.github.com/events", verify=False)'

or from script.py file:

import requests
res = requests.get("https://api.github.com/events", verify=False)
print res

terminal:

$ python script.py
<Response [200]>

Important: Very bad idea; You can be MITM attacked, which is a critical security vulnerability.

这篇关于Python请求抛出SSL错误的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！

查看全文
相关文章
Python最新文章
热门教程
热门工具
登录 关闭
扫码关注1秒登录
发送“验证码”获取 | 15天全站免登陆