SSL CERTIFICATE_VERIFY_FAILED via a proxy

What does SSL: CERTIFICATE_VERIFY_FAILED mean?

During the TLS handshake, the website sends a certificate chain. Your client checks it against a list of trusted authorities, the trust store, and checks names and dates. If any check fails, it stops.

With a CONNECT tunnel, the proxy passes the handshake through untouched, so the certificate you see is the website's own. Something that inserts its own certificate, like inspection software, or a stale trust store on your machine, is the usual cause.

What does CERTIFICATE_VERIFY_FAILED look like in Python, curl, Node.js and browsers?

The same failure prints differently in every tool. These are the messages to search your logs for:

• Python: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate
• Node.js: UNABLE_TO_GET_ISSUER_CERT_LOCALLY or SELF_SIGNED_CERT_IN_CHAIN
• curl: curl: (60) SSL certificate problem: unable to get local issuer certificate
• Browsers: NET::ERR_CERT_AUTHORITY_INVALID

What causes CERTIFICATE_VERIFY_FAILED?

Most likely first:

• An outdated CA bundle, for example an old certifi package in Python.
• HTTPS inspection by antivirus, a corporate firewall or a debugging proxy, which presents its own certificate.
• A wrong system clock that makes valid certificates look expired or not yet valid.
• A website with a broken chain, missing an intermediate certificate.
• A container image without the system CA certificates package.

How do I diagnose CERTIFICATE_VERIFY_FAILED step by step?

1. Run the same request without the proxy. If it also fails, the proxy is not involved.
2. Print the certificate issuer with openssl s_client or curl -v: an issuer named after your antivirus or firewall shows interception.
3. Check the system date and time.
4. Update the CA bundle and test again.

# Use the URL that fails; with https://api.ipify.org instead, you test the gateway alone.
# "HTTP/1.1 200 Connection established" first, then the site's own status: the site answered.
curl -v -x http://USERNAME:[email protected]:7777 https://TARGET_URL

# Same test through the SOCKS5 port, with DNS resolved at the exit
curl -v --socks5-hostname gw.crawlrelay.com:7778 --proxy-user USERNAME:PASSWORD https://TARGET_URL

How do I fix CERTIFICATE_VERIFY_FAILED?

• Update certifi (pip install -U certifi) or your system CA package.
• Add your company's inspection certificate to the trust store if your network requires inspection, or run the scraper outside that network.
• Fix the clock with network time sync.
• Install CA certificates in slim container images, for example the ca-certificates package.
• Do not disable verification in code that sends credentials or collects data you rely on.

Should I retry after CERTIFICATE_VERIFY_FAILED?

Do not retry: the same trust store fails the same way. Fix the trust store, the clock or the network path, then run again.

How does SSL: CERTIFICATE_VERIFY_FAILED apply to CrawlRelay?

CrawlRelay's HTTP port tunnels HTTPS with CONNECT, so the certificate your client checks is the one the website sends. If the error appears only through the gateway and never without it, contact support with the target hostname and the full error so we can check the exit side.

Gateway: gw.crawlrelay.com, port 7777 (HTTP, HTTPS through CONNECT) and port 7778 (SOCKS5). Username format: USERNAME-country-{cc}-state-{state}-city-{city}-zip-{zip}-asn-{asn}-session-{id}-ttl-{minutes}. Related: SSL: WRONG_VERSION_NUMBER · Connection reset · Python guide.