# SSL CERTIFICATE_VERIFY_FAILED via a proxy

> SSL CERTIFICATE_VERIFY_FAILED when scraping through a proxy: old CA bundles, intercepting antivirus or office firewalls, clock errors. Safe fixes only.

- URL: https://crawlrelay.com/docs/errors/ssl-certificate-verify-failed/
- Last updated: 2026-10-13
- Publisher: CrawlRelay (https://crawlrelay.com)

TLS certificate error in the client: the exact message in each tool, the likely causes in order, and the fix that works.

**Quick answer — What does SSL: CERTIFICATE_VERIFY_FAILED mean with a proxy?**

**CERTIFICATE_VERIFY_FAILED** means your client could not validate the website's TLS certificate. Through a CONNECT proxy such as the CrawlRelay gateway, TLS runs end to end, so the proxy does not cause it. Look on your side: an outdated CA bundle, antivirus or an office firewall that inspects HTTPS, or a wrong system clock. Never fix it with verify=False in production.

## SSL: CERTIFICATE_VERIFY_FAILED at a glance

| Attribute | Value |
| --- | --- |
| Error | SSL: CERTIFICATE_VERIFY_FAILED |
| Type | TLS certificate error in the client |
| Sent by | Your TLS library, when it cannot validate the website's certificate |
| Defined in | X.509 path validation: RFC 5280; TLS 1.3: RFC 8446 |
| Retry it? | No. Fix the trust store or the network |
| First check | Test the same URL without the proxy on the same machine |

## What does SSL: CERTIFICATE_VERIFY_FAILED mean?

During the TLS handshake, the website sends a certificate chain. Your client checks it against a list of trusted authorities, the trust store, and checks names and dates. If any check fails, it stops.

With a CONNECT tunnel, the proxy passes the handshake through untouched, so the certificate you see is the website's own. Something that inserts its own certificate, like inspection software, or a stale trust store on your machine, is the usual cause.

## What does CERTIFICATE_VERIFY_FAILED look like in Python, curl, Node.js and browsers?

The same failure prints differently in every tool. These are the messages to search your logs for:

- **Python:** `[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate`
- **Node.js:** `UNABLE_TO_GET_ISSUER_CERT_LOCALLY` or `SELF_SIGNED_CERT_IN_CHAIN`
- **curl:** `curl: (60) SSL certificate problem: unable to get local issuer certificate`
- **Browsers:** `NET::ERR_CERT_AUTHORITY_INVALID`

## What causes CERTIFICATE_VERIFY_FAILED?

Most likely first:

- **An outdated CA bundle**, for example an old `certifi` package in Python.
- **HTTPS inspection** by antivirus, a corporate firewall or a debugging proxy, which presents its own certificate.
- **A wrong system clock** that makes valid certificates look expired or not yet valid.
- **A website with a broken chain**, missing an intermediate certificate.
- **A container image** without the system CA certificates package.

## How do I diagnose CERTIFICATE_VERIFY_FAILED step by step?

1. Run the same request without the proxy. If it also fails, the proxy is not involved.
2. Print the certificate issuer with `openssl s_client` or curl `-v`: an issuer named after your antivirus or firewall shows interception.
3. Check the system date and time.
4. Update the CA bundle and test again.

*Test the failing URL with curl (HTTP port, verbose)*

```bash
# Use the URL that fails; with https://api.ipify.org instead, you test the gateway alone.
# "HTTP/1.1 200 Connection established" first, then the site's own status: the site answered.
curl -v -x http://USERNAME:PASSWORD@gw.crawlrelay.com:7777 https://TARGET_URL

# Same test through the SOCKS5 port, with DNS resolved at the exit
curl -v --socks5-hostname gw.crawlrelay.com:7778 --proxy-user USERNAME:PASSWORD https://TARGET_URL
```

## How do I fix CERTIFICATE_VERIFY_FAILED?

- **Update `certifi`** (`pip install -U certifi`) or your system CA package.
- **Add your company's inspection certificate** to the trust store if your network requires inspection, or run the scraper outside that network.
- **Fix the clock** with network time sync.
- **Install CA certificates** in slim container images, for example the `ca-certificates` package.
- **Do not disable verification** in code that sends credentials or collects data you rely on.

## Should I retry after CERTIFICATE_VERIFY_FAILED?

Do not retry: the same trust store fails the same way. Fix the trust store, the clock or the network path, then run again.

## How does SSL: CERTIFICATE_VERIFY_FAILED apply to CrawlRelay?

CrawlRelay's HTTP port tunnels HTTPS with `CONNECT`, so the certificate your client checks is the one the website sends. If the error appears only through the gateway and never without it, contact support with the target hostname and the full error so we can check the exit side.

Gateway: `gw.crawlrelay.com`, port 7777 (HTTP, HTTPS through CONNECT) and port 7778 (SOCKS5). Username format: `USERNAME-country-{cc}-state-{state}-city-{city}-zip-{zip}-asn-{asn}-session-{id}-ttl-{minutes}`. Related: [SSL: WRONG_VERSION_NUMBER](https://crawlrelay.com/docs/errors/ssl-wrong-version-number/) · [Connection reset](https://crawlrelay.com/docs/errors/connection-reset/) · [Python guide](https://crawlrelay.com/docs/python/).

## SSL: CERTIFICATE_VERIFY_FAILED: questions developers ask

### Can a proxy cause SSL certificate errors?

An intercepting proxy can, because it presents its own certificate. A CONNECT tunnel proxy cannot, because it only forwards encrypted bytes and never sees the handshake contents. Run the same request without the proxy: if the error remains, the cause is on your machine or network.

### Is verify=False safe for scraping?

Not as a fix. It hides interception and broken chains, and an attacker on the path could then read or change your traffic, including tokens and cookies. Use it only for a quick local test, and never in a job that runs unattended or sends credentials.

### Why does it fail in Docker but work on my laptop?

Slim container images often ship without CA certificates, so no certificate can be validated. Install the system CA package in the image, or rely on the certifi bundle in Python. Also check that the container clock is correct.

## Other proxy errors in this reference

- [401 Unauthorized vs 407](https://crawlrelay.com/docs/errors/401-unauthorized/)
- [403 Forbidden](https://crawlrelay.com/docs/errors/403-forbidden/)
- [407 Proxy Authentication Required](https://crawlrelay.com/docs/errors/407-proxy-authentication-required/)
- [429 Too Many Requests](https://crawlrelay.com/docs/errors/429-too-many-requests/)
- [502 Bad Gateway](https://crawlrelay.com/docs/errors/502-bad-gateway/)
- [503 Service Unavailable](https://crawlrelay.com/docs/errors/503-service-unavailable/)
- [504 Gateway Timeout](https://crawlrelay.com/docs/errors/504-gateway-timeout/)
- [Cannot connect to proxy (ProxyError)](https://crawlrelay.com/docs/errors/cannot-connect-to-proxy/)
- [Connection reset by peer (ECONNRESET)](https://crawlrelay.com/docs/errors/connection-reset/)
- [ERR_PROXY_CONNECTION_FAILED](https://crawlrelay.com/docs/errors/err-proxy-connection-failed/)
- [ERR_TUNNEL_CONNECTION_FAILED](https://crawlrelay.com/docs/errors/err-tunnel-connection-failed/)
- [Read timed out (ReadTimeout)](https://crawlrelay.com/docs/errors/read-timeout/)
- [SOCKS5 proxy errors](https://crawlrelay.com/docs/errors/socks5-proxy-errors/)
- [SSL: CERTIFICATE_VERIFY_FAILED](https://crawlrelay.com/docs/errors/ssl-certificate-verify-failed/)
- [SSL: WRONG_VERSION_NUMBER](https://crawlrelay.com/docs/errors/ssl-wrong-version-number/)

**Residential proxies with docs that cover the failure cases** CrawlRelay residential proxies from $0.50/GB, traffic that never expires. [See pricing](https://crawlrelay.com/pricing/) · [Quick start](https://crawlrelay.com/docs/)

---

CrawlRelay: CrawlRelay is a developer-first rotating residential and 4G/5G mobile proxy service for scrapers and AI data pipelines: non-expiring pay-as-you-go traffic from $0.50/GB, paid in crypto, with no ID upload. No KYC — no ID, no selfie, no documents. Pay in crypto.