Certificate verification when using virtual environments

Question

I have a root CA certificate installed on my machine and all is fine when issuing a requests when using the system install of the requests library:

$ python -c 'import requests; print requests.get("https://example.com")'
<Response [200]>

However if I issue the same request from within a virtual environment the certificate verification fails:

$ python -c 'import requests; print requests.get("https://example.com")'
requests.exceptions.SSLError: [Errno 1] _ssl.c:510: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

Using requests.certs.where I can see the system install uses the systems CA bundle and the virtual environment uses the CA bundle shipped with requests:

$ python -c "import requests; print requests.certs.where()"
/etc/ssl/certs/ca-certificates.crt

$ (venv) python -c "import requests; print requests.certs.where()"                                                            
.../venv/local/lib/python2.7/site-packages/requests/cacert.pem

Is there another solution to picking up the system certs without providing the path on each request when using virtualenv, i.e:

>>> requests.get("https://example.com" verify="/etc/ssl/certs/ca-certificates.crt")

Answer 1

If you want to insert a specific CA certificate to your CA bundle of virtualenv, you can just append to it:

openssl x509 -in $specific_ca.crt -text >> $virtualenv/lib/python2.7/site-packages/certifi/cacert.pem