Sign-In to Portal Via Python Script Creates SSL Error for Service Account

Question

We recently updated the SSL certificate for our single-machine base deployment of ArcGIS Enterprise 11.1.  With my organizational user account, I can sign-in and access the Portal via a Python script from both my laptop, and logged onto the server.

However, whenever I am logged onto the Windows server with a service account (headless user), I get the following error when signing-in to the Portal.  Note, the same script is run.  The only difference is whom is logged into the server.

Does anyone have any ideas what might be causing this issue?

2024-12-16 18:00:22,869 - signing into Portal…

2024-12-16 18:00:25,237 - Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)'))': /portal/sharing/rest/info?f=json

2024-12-16 18:00:31,236 - Failed at Line 40

2024-12-16 18:00:31,236 - Error: Please set verify_cert=False due to encountered SSL error: HTTPSConnectionPool(host='gis.health.pa.gov', port=443): Max retries exceeded with url: /portal/sharing/rest/info?f=json (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)')))

FredericPoliart_EsriAU · Answer

Today, for some strange reaon, I started receiving this same error[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)'))
on a python script that I use pretty much every day.

How I fixed it:

add:  
   urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

add verify_cert=False on this line:
   gis = GIS(source_portal_url, token = mytoken, verify_cert=False)

add verify=False on this line:
   requests.get(url, params={"token": token}, verify=False)

.. then it works again to fetch a Portal URL to an image (purpose of the python script in my case)

WHY TODAY!?!?!

> Could is be SSL CERT validation becomes expired? 
>

SRK · Answer

I am behind a coporate firewall and it seems arcgis-python3 does not has the locally installed certificate from windows, as i can call a webadress in multiple browsers but not in python. I am using the default arcgis-python3 enviroment, but due to that i can't add custom certs in the certifi cert bundle as the directory is writeprotected...
How can i update cerifi to include sytem certs oder check if they are used?

Edit: I found this post which is almost 4 years old and the solution really should not be manually changing the .pem cert bundle... Is there really no update function to check for the current windows certs??

Aled Wyn Jones · Answer

@JoshuaBixby @McKinneyPatrick_PA

Apologies Josh, yes I should've specified that this is necessary whilst using a cloned conda environment (via arcgispro-py3) and whilst making use of python libraries within that conda environment e.g. requests.

I've come across this recently whilst using a cloned conda environment and using verify=True when querying a job URL via requests:

response = requests.post(                        status_url,                        params={'f': 'json', 'token': token},                        verify=True                    )(Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)')))