{"id":"4555c0be2901eb35","repo":"psf/requests","slug":"could-not-find-a-suitable-tls-ca-certificate-bundl","errorCode":null,"errorMessage":"Could not find a suitable TLS CA certificate bundle, invalid path: {cert_loc}","messagePattern":"Could not find a suitable TLS CA certificate bundle, invalid path: (.+?)","errorType":"exception","errorClass":"OSError","httpStatus":null,"severity":"error","filePath":"src/requests/adapters.py","lineNumber":332,"sourceCode":"        :param conn: The urllib3 connection object associated with the cert.\n        :param url: The requested URL.\n        :param verify: Either a boolean, in which case it controls whether we verify\n            the server's TLS certificate, or a string, in which case it must be a path\n            to a CA bundle to use\n        :param cert: The SSL certificate to verify.\n        \"\"\"\n        if url.lower().startswith(\"https\") and verify:\n            cert_loc = None\n\n            # Allow self-specified cert location.\n            if verify is not True:\n                cert_loc = verify\n\n            if not cert_loc:\n                cert_loc = DEFAULT_CA_BUNDLE_PATH\n\n            if not cert_loc or not os.path.exists(cert_loc):\n                raise OSError(\n                    f\"Could not find a suitable TLS CA certificate bundle, \"\n                    f\"invalid path: {cert_loc}\"\n                )\n\n            conn.cert_reqs = \"CERT_REQUIRED\"\n\n            if not os.path.isdir(cert_loc):\n                conn.ca_certs = cert_loc\n            else:\n                conn.ca_cert_dir = cert_loc\n        else:\n            conn.cert_reqs = \"CERT_NONE\"\n            conn.ca_certs = None\n            conn.ca_cert_dir = None\n\n        if cert:\n            if not isinstance(cert, basestring):\n                conn.cert_file = cert[0]","sourceCodeStart":314,"sourceCodeEnd":350,"githubUrl":"https://github.com/psf/requests/blob/414f0513c33883adf6f2b46901d4f0b38a455851/src/requests/adapters.py#L314-L350","documentation":"HTTPAdapter.cert_verify raises this OSError when TLS verification is enabled for an https URL but the CA bundle path it resolved does not exist. The path comes either from the user's `verify` argument (when it's a string) or falls back to DEFAULT_CA_BUNDLE_PATH (certifi's bundle); if neither yields an existing file or directory, the request cannot verify the server certificate and requests fails fast rather than connecting insecurely.","triggerScenarios":"requests.get('https://...', verify='/path/to/ca.pem') with a wrong or nonexistent path; REQUESTS_CA_BUNDLE or CURL_CA_BUNDLE env vars pointing to a missing file; certifi missing or its cacert.pem stripped (DEFAULT_CA_BUNDLE_PATH invalid). Raised at src/requests/adapters.py:331-335 only for https URLs with verify truthy.","commonSituations":"Frozen apps (PyInstaller/cx_Freeze) that don't package certifi's cacert.pem; Docker images or CI where REQUESTS_CA_BUNDLE points at a corporate CA file that isn't mounted; typo'd verify= paths; corporate-proxy setups where the internal CA bundle path differs between machines; broken certifi installs after aggressive site-packages pruning.","solutions":["Check the path in the error and fix the verify= argument or REQUESTS_CA_BUNDLE/CURL_CA_BUNDLE env var to an existing PEM file","Reinstall certifi (pip install --force-reinstall certifi) if the default bundle is missing","In frozen builds, bundle certifi's cacert.pem and point verify/REQUESTS_CA_BUNDLE at the extracted path","If appending a corporate CA, concatenate it with certifi's bundle into a file that actually exists and pass that path"],"exampleFix":"# before\nrequests.get(url, verify='/etc/ssl/corp-ca.pem')  # file not mounted -> OSError\n\n# after\nimport certifi, os\nbundle = os.environ.get('REQUESTS_CA_BUNDLE', certifi.where())\nrequests.get(url, verify=bundle)","handlingStrategy":"validation","validationCode":"import os\ncert_loc = verify_path  # value passed as verify= or REQUESTS_CA_BUNDLE\nif isinstance(cert_loc, str) and not os.path.exists(cert_loc):\n    raise FileNotFoundError(f\"CA bundle not found: {cert_loc}\")","typeGuard":null,"tryCatchPattern":"try:\n    resp = session.get(url, verify=ca_bundle_path)\nexcept OSError as e:\n    # requests raises OSError('Could not find a suitable TLS CA certificate bundle...')\n    raise RuntimeError(f\"CA bundle path invalid: {ca_bundle_path}\") from e","preventionTips":["Validate REQUESTS_CA_BUNDLE / CURL_CA_BUNDLE and any verify= path with os.path.exists at process startup","Use absolute paths for CA bundles; relative paths break when cwd changes","Prefer certifi.where() over hand-maintained bundle paths unless a private CA is required"],"tags":["tls","certificates","configuration","python","https"],"analyzedSha":"414f0513c33883adf6f2b46901d4f0b38a455851","analyzedAt":"2026-07-31T19:24:57.696Z","schemaVersion":2}