{"id":241,"library":"certifi","title":"certifi","description":"certifi provides Mozilla's carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Extracted from the Requests project, it exposes a single public API — certifi.where() — returning the filesystem path to the bundled cacert.pem. The current version is 2026.2.25 (versioned by release date). Releases are issued roughly every 1–3 months, tracking Mozilla's own CA store updates.","status":"active","version":"2026.2.25","language":"python","source_language":"en","source_url":"https://github.com/certifi/python-certifi","tags":["ssl","tls","certificates","ca-bundle","security","requests","urllib3","https"],"install":[{"cmd":"pip install certifi","lang":"bash","label":"pip"},{"cmd":"pip install --upgrade certifi","lang":"bash","label":"upgrade to latest"}],"dependencies":[],"imports":[{"note":"certifi.old_where() was kept as an alias of certifi.where() after 1024-bit root removal but should no longer be used; call certifi.where() directly.","wrong":"from certifi import old_where; old_where()","symbol":"certifi","correct":"import certifi\ncertifi.where()"},{"note":"certifi.where() is the entire public API. It returns a string file path, not a file object or a list of certs.","symbol":"certifi.where","correct":"import certifi\npath = certifi.where()  # returns str path to cacert.pem"}],"quickstart":{"code":"import certifi\nimport requests\nimport urllib3\nimport ssl\n\n# 1. Print the path to the bundled CA bundle\nprint(certifi.where())  # e.g. /path/to/certifi/cacert.pem\n\n# 2. Pass explicitly to requests (requests uses certifi automatically,\n#    but being explicit avoids surprises when REQUESTS_CA_BUNDLE is set)\nresponse = requests.get(\"https://httpbin.org/get\", verify=certifi.where())\nprint(response.status_code)\n\n# 3. Pass to urllib3 directly\nhttp = urllib3.PoolManager(ca_certs=certifi.where())\nr = http.request(\"GET\", \"https://httpbin.org/get\")\nprint(r.status)\n\n# 4. Pass to the stdlib ssl module\nctx = ssl.create_default_context(cafile=certifi.where())\nprint(ctx)\n","lang":"python","description":"Use certifi.where() with requests, urllib3, and the stdlib ssl module to pin SSL verification to the bundled Mozilla CA store."},"warnings":[{"fix":"Pin to certifi>=2023.07.22 or, preferably, always allow the latest release: pip install --upgrade certifi.","message":"Versions <2023.07.22 include compromised 'e-Tugra' root certificates (CVE / GHSA-xqr8-7jwr-rhp7). Any pinned version in that range must be upgraded.","severity":"breaking","affected_versions":">=2015.04.28,<2023.07.22"},{"fix":"Remove all calls to certifi.old_where() and replace with certifi.where(). Weak 1024-bit roots will not be available.","message":"certifi.old_where() was removed and re-added only as a no-op alias of certifi.where(). Code that relied on it to restore 1024-bit root certificates no longer gets those weak roots.","severity":"breaking","affected_versions":"<2018.x"},{"fix":"Use the REQUESTS_CA_BUNDLE or SSL_CERT_FILE environment variables pointing to a separate PEM file that includes both the certifi bundle and your custom CA, or use requests' verify='/path/to/custom.pem' per-call parameter.","message":"certifi explicitly does NOT support modifying the CA store. Writing custom CAs directly into cacert.pem is overwritten on every package upgrade.","severity":"gotcha","affected_versions":"all"},{"fix":"Run /Applications/Python\\ 3.x/Install\\ Certificates.command once after installation, or set SSL_CERT_FILE=$(python -m certifi) and REQUESTS_CA_BUNDLE=$(python -m certifi) in your shell profile.","message":"On macOS (python.org installer), Python does NOT automatically use the system Keychain. SSL errors like CERTIFICATE_VERIFY_FAILED appear immediately after a fresh install.","severity":"gotcha","affected_versions":"all"},{"fix":"Be intentional: pass verify=certifi.where() explicitly if you need to override environment-level CA bundle variables, otherwise omit it and let requests resolve the default.","message":"requests bundles certifi as a dependency and uses it automatically; explicitly passing verify=certifi.where() is redundant in most cases but required when REQUESTS_CA_BUNDLE or SSL_CERT_FILE overrides are set in the environment and you want to force the certifi store.","severity":"gotcha","affected_versions":"all"},{"fix":"Append the corporate root CA PEM to a copy of certifi.where() and point REQUESTS_CA_BUNDLE at that merged file, or use the truststore package (pip install truststore) to load the OS native trust store.","message":"certifi does not read or merge the operating system's CA trust store on any platform. Corporate proxies doing TLS inspection with an internal root CA will cause SSLError even with certifi up to date.","severity":"gotcha","affected_versions":"all"},{"fix":"Upgrade to Python 3.7+ before installing certifi 2022.x or later.","message":"Python 2 support was dropped. certifi now requires Python >=3.7 as per its package metadata.","severity":"deprecated","affected_versions":"<2022.x on Python 2"},{"fix":"Ensure the 'requests' package is installed in the test environment using 'pip install requests'.","message":"The 'requests' package is not installed, leading to a ModuleNotFoundError when attempting to import it. The test environment only shows 'certifi' being installed.","severity":"breaking","affected_versions":"all"},{"fix":"Ensure 'requests' is installed alongside 'certifi': pip install requests.","message":"The test script or application requires the 'requests' package but it is not installed, leading to `ModuleNotFoundError: No module named 'requests'`. While 'certifi' is often used by 'requests', it does not automatically install 'requests' as a dependency.","severity":"gotcha","affected_versions":"all"}],"env_vars":null,"last_verified":"2026-05-12T12:17:14.029Z","next_check":"2026-06-25T00:00:00.000Z","problems":[{"fix":"Install the certifi package using pip: `pip install certifi`","cause":"The 'certifi' package is not installed in the Python environment where the code is being executed, or the environment is not correctly configured to find installed packages.","error":"ModuleNotFoundError: No module named 'certifi'"},{"fix":"Upgrade the certifi package to ensure you have the latest collection of root certificates: `pip install --upgrade certifi`","cause":"The SSL certificate presented by the server could not be verified against the trusted root certificates provided by certifi, often because the certifi package is outdated or the system's SSL certificates are not up to date. This commonly manifests as `requests.exceptions.SSLError`.","error":"SSL: CERTIFICATE_VERIFY_FAILED"},{"fix":"First, identify if environment variables like `REQUESTS_CA_BUNDLE` or `CURL_CA_BUNDLE` are set and pointing to an invalid location. Clear or correct these variables. Ensure `certifi` is installed and up-to-date (`pip install --upgrade certifi`). If pip itself is failing, explicitly tell pip to use certifi's bundle by adding `[global] cert = C:\\path\\to\\certifi\\cacert.pem` to your pip configuration file (e.g., `%APPDATA%\\pip\\pip.ini` on Windows, or `~/.config/pip/pip.conf` on Unix), replacing the path with the output of `python -c \"import certifi; print(certifi.where())\"`","cause":"A Python application, or even `pip` itself, is configured to look for SSL/TLS certificates at a specific path, but the file or directory at that path is missing or incorrect. This can be due to misconfigured environment variables (e.g., `REQUESTS_CA_BUNDLE`, `CURL_CA_BUNDLE`) or corrupted installations.","error":"OSError: Could not find a suitable TLS CA certificate bundle, invalid path"}],"ecosystem":"pypi","meta_description":null,"install_score":100,"install_tag":"verified","quickstart_score":0,"quickstart_tag":"stale","pypi_latest":null,"install_checks":{"last_tested":"2026-05-12","tag":"verified","tag_description":"installs cleanly on critical runtimes, fast import, recently tested","results":[{"runtime":"python:3.10-alpine","python_version":"3.10","os_libc":"alpine (musl)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.04,"mem_mb":1.9,"disk_size":"18.0M"},{"runtime":"python:3.10-alpine","python_version":"3.10","os_libc":"alpine (musl)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.04,"mem_mb":1.9,"disk_size":"18.0M"},{"runtime":"python:3.10-slim","python_version":"3.10","os_libc":"slim (glibc)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.03,"mem_mb":1.9,"disk_size":"19M"},{"runtime":"python:3.10-slim","python_version":"3.10","os_libc":"slim (glibc)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.02,"mem_mb":1.9,"disk_size":"19M"},{"runtime":"python:3.11-alpine","python_version":"3.11","os_libc":"alpine (musl)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.06,"mem_mb":2,"disk_size":"19.9M"},{"runtime":"python:3.11-alpine","python_version":"3.11","os_libc":"alpine (musl)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.06,"mem_mb":2,"disk_size":"19.9M"},{"runtime":"python:3.11-slim","python_version":"3.11","os_libc":"slim (glibc)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.04,"mem_mb":2,"disk_size":"20M"},{"runtime":"python:3.11-slim","python_version":"3.11","os_libc":"slim (glibc)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.04,"mem_mb":2,"disk_size":"20M"},{"runtime":"python:3.12-alpine","python_version":"3.12","os_libc":"alpine (musl)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.07,"mem_mb":2.7,"disk_size":"11.8M"},{"runtime":"python:3.12-alpine","python_version":"3.12","os_libc":"alpine (musl)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.07,"mem_mb":2.7,"disk_size":"11.8M"},{"runtime":"python:3.12-slim","python_version":"3.12","os_libc":"slim (glibc)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.07,"mem_mb":2.7,"disk_size":"12M"},{"runtime":"python:3.12-slim","python_version":"3.12","os_libc":"slim (glibc)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.07,"mem_mb":2.7,"disk_size":"12M"},{"runtime":"python:3.13-alpine","python_version":"3.13","os_libc":"alpine (musl)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.06,"mem_mb":2.6,"disk_size":"11.4M"},{"runtime":"python:3.13-alpine","python_version":"3.13","os_libc":"alpine (musl)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.06,"mem_mb":2.6,"disk_size":"11.4M"},{"runtime":"python:3.13-slim","python_version":"3.13","os_libc":"slim (glibc)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.07,"mem_mb":2.4,"disk_size":"12M"},{"runtime":"python:3.13-slim","python_version":"3.13","os_libc":"slim (glibc)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.06,"mem_mb":2.4,"disk_size":"12M"},{"runtime":"python:3.9-alpine","python_version":"3.9","os_libc":"alpine (musl)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.04,"mem_mb":2.1,"disk_size":"17.5M"},{"runtime":"python:3.9-alpine","python_version":"3.9","os_libc":"alpine (musl)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.04,"mem_mb":2.1,"disk_size":"17.5M"},{"runtime":"python:3.9-slim","python_version":"3.9","os_libc":"slim (glibc)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.03,"mem_mb":2.1,"disk_size":"18M"},{"runtime":"python:3.9-slim","python_version":"3.9","os_libc":"slim (glibc)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.03,"mem_mb":2.1,"disk_size":"18M"}]},"quickstart_checks":{"last_tested":"2026-04-23","tag":"stale","tag_description":"widespread failures or data too old to trust","results":[{"runtime":"python:3.10-alpine","exit_code":1},{"runtime":"python:3.10-slim","exit_code":1},{"runtime":"python:3.11-alpine","exit_code":1},{"runtime":"python:3.11-slim","exit_code":1},{"runtime":"python:3.12-alpine","exit_code":1},{"runtime":"python:3.12-slim","exit_code":1},{"runtime":"python:3.13-alpine","exit_code":1},{"runtime":"python:3.13-slim","exit_code":1},{"runtime":"python:3.9-alpine","exit_code":1},{"runtime":"python:3.9-slim","exit_code":1}]}}