SSLCertVerificationError 해결: CERTIFICATE_VERIFY_FAILED 원인 5종 판별법

Traceback (most recent call last):
  File ".../urllib3/connectionpool.py", line 715, in urlopen
  File ".../urllib3/connectionpool.py", line 1058, in _validate_conn
  File ".../urllib3/connection.py", line 419, in connect
  File ".../ssl.py", line 517, in wrap_socket
  File ".../ssl.py", line 1108, in _create
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed:
unable to get local issuer certificate (_ssl.c:1000)

During handling of the above exception, another exception occurred:
requests.exceptions.SSLError: HTTPSConnectionPool(host='api.example.com', port=443):
Max retries exceeded with url: /v1/ping
(Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] ...')))

[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'api.example.com'

python -c "import ssl, certifi; print(certifi.where()); print(ssl.OPENSSL_VERSION)"

/usr/lib/python3.11/site-packages/certifi/cacert.pem
OpenSSL 3.0.13 30 Jan 2024

openssl s_client -connect api.example.com:443 -servername api.example.com -showcerts </dev/null 2>/dev/null \
  | grep -E "^(depth|verify|Verify| [0-9] s:| [0-9] i:)"

 0 s:CN=api.example.com
   i:C=US, O=Let's Encrypt, CN=R11
 1 s:C=US, O=Let's Encrypt, CN=R11
   i:C=US, O=Internet Security Research Group, CN=ISRG Root X1
Verify return code: 0 (ok)

 0 s:CN=api.example.com
   i:CN=Zscaler Intermediate Root CA (zscaler.net)
 1 s:CN=Zscaler Intermediate Root CA (zscaler.net)
   i:CN=Zscaler Root CA
Verify return code: 19 (self signed certificate in certificate chain)

curl -v https://api.example.com/ 2>&1 | grep -E "CAfile|SSL certificate|subject|issuer"
python - <<'PY'
import requests
try:
    requests.get("https://api.example.com/", timeout=5)
    print("PY OK")
except Exception as e:
    print("PY FAIL:", e)
PY

pip install truststore

import truststore
truststore.inject_into_ssl()   # 이 이후 생성되는 모든 SSLContext가 OS 저장소 사용

import requests
print(requests.get("https://api.example.com/", timeout=5).status_code)

pip install pip-system-certs

sudo mkdir -p /opt/ca
cat "$(python -m certifi)" /path/to/corp-root.crt > /opt/ca/corp-bundle.pem

# 전역 적용
export SSL_CERT_FILE=/opt/ca/corp-bundle.pem
export REQUESTS_CA_BUNDLE=/opt/ca/corp-bundle.pem

# 검증
python -c "import requests;print(requests.get('https://api.example.com/',timeout=5).status_code)"

openssl x509 -inform der -in corp-root.der -out corp-root.crt

# Ubuntu / Debian
sudo cp corp-root.crt /usr/local/share/ca-certificates/corp-root.crt
sudo update-ca-certificates          # "1 added" 출력이 정상

# RHEL / Rocky
sudo cp corp-root.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust extract

# macOS: python.org 설치본이라면 먼저 이것
/Applications/Python\ 3.12/Install\ Certificates.command
# 키체인 등록
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain corp-root.crt

# Windows (관리자 PowerShell)
certutil -addstore -f "Root" C:\certs\corp-root.crt
Import-Certificate -FilePath C:\certs\corp-root.crt -CertStoreLocation Cert:\LocalMachine\Root

# ⚠️ TODO(2026-08-31 제거): 폐쇄망 스테이징 전용. 운영 반영 금지.
# 사내 루트 CA 배포(INFRA-1234) 완료 후 verify=/opt/ca/corp-bundle.pem 으로 교체
import urllib3, requests
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
requests.get("https://internal.example.local/health", verify=False, timeout=5)

pip install requests \
  --trusted-host pypi.org \
  --trusted-host files.pythonhosted.org \
  --trusted-host pypi.python.org

[global]
cert = /opt/ca/corp-bundle.pem
index-url = https://pypi.org/simple

[install]
trusted-host =
    pypi.org
    files.pythonhosted.org

FROM python:3.12-slim

RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates \
 && rm -rf /var/lib/apt/lists/*

# 사내 루트 CA 반영
COPY corp-root.crt /usr/local/share/ca-certificates/corp-root.crt
RUN update-ca-certificates

ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt \
    REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt

import ssl, aiohttp

ctx = ssl.create_default_context(cafile="/opt/ca/corp-bundle.pem")

async def fetch(url):
    async with aiohttp.ClientSession() as s:
        async with s.get(url, ssl=ctx) as r:
            return await r.text()

에러 원문 확인
 ├ unable to get local issuer (20) ─ openssl s_client 로 체인 확인
 │    ├ Issuer가 사내/보안장비 → 루트 CA 등록 (truststore 또는 번들 병합)
 │    └ 체인 1개뿐 → 서버에 fullchain 배포 요청
 ├ self signed in chain (19) ────── 사내 MITM 확정 → 루트 CA 등록
 ├ certificate has expired (10) ─── date 확인 → 서버 인증서 만료일 확인
 └ hostname mismatch ───────────── SAN/SNI/IP 접속 여부 확인