[Python] Python requests library refusing to accept correct verify certificate

The following application performs a basic HTTP GET request against https://google.com, retrieves the peer certificate and saves it in PEM format into a file called cert.pem.

After that it attempts the connect to https://google.com again, but this time specifies the saved certificate (cert.pem) in the verify parameter:

import requests
from cryptography import x509
from cryptography.hazmat.primitives import serialization

with requests.get("https://google.com", stream=True) as response:
cert = response.raw.connection.sock.getpeercert(binary_form =True)

cert_der = x509.load_der_x509_certificate(cert)
cert_pem = cert_der.public_bytes(serialization.Encoding.PEM)

with open("cert.pem", "wb") as f:
f.write(cert_pem)


with requests.get("https://google.com", stream=True, verify='./cert.pem') as response:
cert = response.raw.connection.sock.getpeercert(binary_form =True)


When I execute this application the second requests.get(...) invocation fails with the following error:

requests.exceptions.SSLError: HTTPSConnectionPool(host='google.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1131)')))


This doesn't make sense, as it's the certificate that was provided by the same webserver in the first request. I have validated that this works using the curl cli:

curl -v --cacert ./cert.pem --capath ./ https://www.google.com

Continue reading...