SSL: CERTIFICATE_VERIFY_FAILED

1
2
3
4
5
6
7
8

# 証明書の有効期限を確認
openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

# 証明書チェーンを確認
openssl s_client -connect example.com:443 -showcerts

# 証明書の詳細
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -text

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

import ssl
import certifi
import requests

# certifi を使用（推奨）
response = requests.get('https://example.com', verify=certifi.where())

# カスタムCA証明書を指定
response = requests.get('https://example.com', verify='/path/to/ca-bundle.crt')

# 検証を無効化（開発環境のみ！）
response = requests.get('https://example.com', verify=False)

# SSLコンテキストをカスタマイズ
context = ssl.create_default_context(cafile=certifi.where())

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

const https = require('https');
const fs = require('fs');

// カスタムCA証明書
const agent = new https.Agent({
  ca: fs.readFileSync('/path/to/ca-cert.pem')
});

fetch('https://example.com', { agent });

// 環境変数で指定
process.env.NODE_EXTRA_CA_CERTS = '/path/to/ca-cert.pem';

// 検証を無効化（開発環境のみ！）
process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';

1
2
3
4
5
6
7
8
9

# CA証明書を指定
curl --cacert /path/to/ca-bundle.crt https://example.com

# 検証を無効化（非推奨）
curl -k https://example.com
curl --insecure https://example.com

# 詳細なデバッグ
curl -v https://example.com

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# Ubuntu/Debian
sudo apt update && sudo apt install ca-certificates
sudo update-ca-certificates

# CentOS/RHEL
sudo yum update ca-certificates

# macOS
# Homebrewでcertifiを更新
brew upgrade openssl

# Python certifi
pip install --upgrade certifi

1
2
3
4
5
6

# Nginx
server {
    listen 443 ssl;
    ssl_certificate /etc/ssl/certs/fullchain.pem;  # 中間証明書を含む
    ssl_certificate_key /etc/ssl/private/key.pem;
}

1
2
3
4

# Apache
SSLCertificateFile /etc/ssl/certs/server.crt
SSLCertificateChainFile /etc/ssl/certs/intermediate.crt
SSLCertificateKeyFile /etc/ssl/private/server.key

1
2
3
4

# 開発用自己署名証明書
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes \
  -subj "/CN=localhost" \
  -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"

1
2
3
4
5

# certbot でSSL証明書を取得
sudo certbot --nginx -d example.com

# 自動更新の確認
sudo certbot renew --dry-run

1
2
3
4
5

# CA証明書をコピー
FROM node:18-alpine
RUN apk add --no-cache ca-certificates
COPY ./ca-certificates /usr/local/share/ca-certificates/
RUN update-ca-certificates

1
2
3
4
5

# SSLLabsでテスト
curl https://api.ssllabs.com/api/v3/analyze?host=example.com

# ローカルで確認
openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt server.crt