"unable to get local issuer certificate", even though cURL works with the same website about urllib3 HOT 3 CLOSED

Curl may look up and retrieve the intermediates which is what browsers do but openssl does not do this and Python is using openssl so it does not do it. Furthermore, it is widely frowned upon as a bad practice even if browsers have no good way of undoing the harm they have done. Please file a bug with your gitlab instance managers to do the right thing here. They should be returning the full chain

from urllib3.

This sounds like your internal GitLab instance is mis-configured and/or the certificate chain you've been provided are not complete. Without knowing how your company is managing its internal PKI system, let me give you some details:

There is typically a Root of the chain of trust. This, if your company is following CA/B forum standards can be valid for 20-25 years.

There is typically also at least one other chain between the Root and an issued certificate, i.e., the Issuer. This is typically valid for ~5-10 years.

The Issuer is what signs and provides the certificate for a service. The service (GitLab in your case) should be returning in the TLS Handshake:

• Its certificate
• The certificate for the Issuer
• The certificate for the Root

If it only provides its certificate, then urllib3 cannot verify that if the Issuer is not in your set of trusted certificates.

You can see what your server provides by using openssl s_client -connect gitlab.company.com:443 and seeing what Certs are returned. Likewise, cURL will show you certificate information with -vv (or maybe -vvv I can't remember which) and show you what it does for TLS verification. Also, please include your curl command when you say that it works since it's possible you're specifying a flag that in fact makes it work but does not verify TLS certificate chains of trust.

from urllib3.

I finally managed to resolve the issue. In fact, I didn't have the whole certificate chain installed in the container. The weirdest thing is that cURL worked. The output just shows this during certificate verification:

# curl -vvv https://gitlab.company.com
...
* Server certificate:
*  subject: CN=*.company.com
*  start date: Oct 25 13:07:21 2023 GMT
*  expire date: Oct 24 13:07:20 2024 GMT
*  subjectAltName: host "gitlab.company.com" matched cert's "*.company.com"
*  issuer: C=PL; O=cyber_Folks S.A.; CN=cyber_Folks
*  SSL certificate verify ok.
...

It looks like cURL doesn't verify the whole chain.

So you were right that the problem was not with urllib3, but I reported it as a bug, since cURL worked. Anyway, thank you for your help. I'm still learning about certificates.

from urllib3.