Your TLS library, refusing the chain it was offered.
CERTIFICATE_VERIFY_FAILED — Certificate verify failed / expired
The certificate did not validate. The message names the reason — expired, hostname mismatch, self-signed, unknown issuer — and the reason decides whether this is the site's problem or yours.
A proxy does not fix this. The certificate belongs to the target, and your address is not part of the chain. A proxy can only change this by breaking it further, which is what disabling verification does.
Why it happens
The site's certificate genuinely expired, which happens more than anyone admits.
A missing intermediate: browsers paper over it by fetching the issuer, most HTTP libraries do not.
A corporate MITM appliance re-signing traffic with a root your client does not trust.
An outdated CA bundle in the runtime — the usual cause on old containers.
How to fix it
- Read which reason your library gave; expired, mismatched and untrusted are three different problems.
- Update the CA bundle before anything else if the target works in a browser.
- Do not disable verification to make it pass. That converts a diagnosable failure into a silent one and removes the protection you were paying for.
FAQ
What does CERTIFICATE_VERIFY_FAILED mean?›
The certificate did not validate. The message names the reason — expired, hostname mismatch, self-signed, unknown issuer — and the reason decides whether this is the site's problem or yours. Your TLS library, refusing the chain it was offered.
Why am I getting CERTIFICATE_VERIFY_FAILED?›
The site's certificate genuinely expired, which happens more than anyone admits. A missing intermediate: browsers paper over it by fetching the issuer, most HTTP libraries do not. A corporate MITM appliance re-signing traffic with a root your client does not trust. An outdated CA bundle in the runtime — the usual cause on old containers.
How do I fix CERTIFICATE_VERIFY_FAILED?›
Read which reason your library gave; expired, mismatched and untrusted are three different problems. Update the CA bundle before anything else if the target works in a browser. Do not disable verification to make it pass. That converts a diagnosable failure into a silent one and removes the protection you were paying for.
Will a proxy fix CERTIFICATE_VERIFY_FAILED?›
The certificate belongs to the target, and your address is not part of the chain. A proxy can only change this by breaking it further, which is what disabling verification does.