requests has problems with SSL under WinPython

[mafeu]

Hi everybody,

I have the following code:

import urllib3
import requests

url = "https://sha256.badssl.com/" # it's actually good (in regards to SSL), not bad :-)

resp1 = urllib3.request("GET", url)

if resp1.status == 200:
    print("Results via urllib3:")
    print(resp1.data)

resp2 = requests.get(url)

if resp2.status_code == 200:
    print("Results via requests:")
    print(resp1.text)

When I run the above code on Ubuntu 25.10 with

• python 3.13.7 (python3.13-minimal (3.13.7-1ubuntu0.3))
  
• urllib3 version 2.3.0
  
• requests version 2.32.3
  

everyting works fine and I get expected output from both the urllib3-request as well as the requests-request.

However, when I run the exact same code on Windows 11 with

• Python 3.14.3 (main, Feb 12 2026, 00:39:15) [MSC v.1944 64 bit (AMD64)] on win32 via WinPython (WinPython64-3.14.3.0slim)
  
• urllib3 version 2.6.3
  
• requests version 2.32.5
  

the urllib3-request works fine like on Ubuntu, but the requests-request fails with

Error:
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1081)

This is even more puzzeling as in my understanding requests is wrapping around urllib3.

I can reproduce the this behavior with any URL that uses TLS, i.e. any https://-URL.

Searching the net I couldn't find any hint on this problem. So I figure with requests on Windows I am doing something essential quite wrong or I might be missing some very basic stuff on the Windows machine.

I don't know if this is of any relevance but the Ubuntu machine is connected to unfiltered Internet while the Windows machine is a company laptop running zscaler setting up a VPN to a trusted endpoint.

Anyone any idea?

Best regards,
Martin

[mafeu]

In case this is of importance, this is the full traceback:

Error:
Traceback (most recent call last):
  File "C:\d\portable\wp\WPy64-3.14.3.0\python\Lib\site-packages\urllib3\connectionpool.py", line 464, in _make_request
    self._validate_conn(conn)
  File "C:\d\portable\wp\WPy64-3.14.3.0\python\Lib\site-packages\urllib3\connectionpool.py", line 1093, in _validate_conn
    conn.connect()
  File "C:\d\portable\wp\WPy64-3.14.3.0\python\Lib\site-packages\urllib3\connection.py", line 796, in connect
    sock_and_verified = _ssl_wrap_socket_and_match_hostname(
  File "C:\d\portable\wp\WPy64-3.14.3.0\python\Lib\site-packages\urllib3\connection.py", line 975, in _ssl_wrap_socket_and_match_hostname
    ssl_sock = ssl_wrap_socket(
  File "C:\d\portable\wp\WPy64-3.14.3.0\python\Lib\site-packages\urllib3\util\ssl_.py", line 483, in ssl_wrap_socket
    ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
  File "C:\d\portable\wp\WPy64-3.14.3.0\python\Lib\site-packages\urllib3\util\ssl_.py", line 527, in _ssl_wrap_socket_impl
    return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
  File "C:\d\portable\wp\WPy64-3.14.3.0\python\Lib\ssl.py", line 455, in wrap_socket
    return self.sslsocket_class._create(
  File "C:\d\portable\wp\WPy64-3.14.3.0\python\Lib\ssl.py", line 1076, in _create
    self.do_handshake()
  File "C:\d\portable\wp\WPy64-3.14.3.0\python\Lib\ssl.py", line 1372, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1081)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:\d\portable\wp\WPy64-3.14.3.0\python\Lib\site-packages\urllib3\connectionpool.py", line 787, in urlopen
    response = self._make_request(
  File "C:\d\portable\wp\WPy64-3.14.3.0\python\Lib\site-packages\urllib3\connectionpool.py", line 488, in _make_request
    raise new_e
urllib3.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1081)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "C:\d\portable\wp\WPy64-3.14.3.0\python\Lib\site-packages\requests\adapters.py", line 644, in send
    resp = conn.urlopen(
  File "C:\d\portable\wp\WPy64-3.14.3.0\python\Lib\site-packages\urllib3\connectionpool.py", line 841, in urlopen
    retries = retries.increment(
  File "C:\d\portable\wp\WPy64-3.14.3.0\python\Lib\site-packages\urllib3\util\retry.py", line 535, in increment
    raise MaxRetryError(_pool, url, reason) from reason  # type: ignore[arg-type]
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='sha256.badssl.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1081)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "C:/d/portable/wp/WPy64-3.14.3.0/notebooks/requests_ssl_problem_demonstation_code.py", line 12, in <module>
    resp2 = requests.get(url)
  File "C:\d\portable\wp\WPy64-3.14.3.0\python\Lib\site-packages\requests\api.py", line 73, in get
    return request("get", url, params=params, **kwargs)
  File "C:\d\portable\wp\WPy64-3.14.3.0\python\Lib\site-packages\requests\api.py", line 59, in request
    return session.request(method=method, url=url, **kwargs)
  File "C:\d\portable\wp\WPy64-3.14.3.0\python\Lib\site-packages\requests\sessions.py", line 589, in request
    resp = self.send(prep, **send_kwargs)
  File "C:\d\portable\wp\WPy64-3.14.3.0\python\Lib\site-packages\requests\sessions.py", line 703, in send
    r = adapter.send(request, **kwargs)
  File "C:\d\portable\wp\WPy64-3.14.3.0\python\Lib\site-packages\requests\adapters.py", line 675, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='sha256.badssl.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1081)')))