blocks|key|1898379|text|如果您希望使用SSL而不必指定--no-verify-ssl选项，则需要设置AWS_CA_BUNDLE环境变量。例如来自PowerShell：|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|1898380|setx+AWS_CA_BUNDLE+"C:\Users\UserX\Documents\RootCert.pem"|code-block|syntax|javascript|1898381|PEM文件是您尝试连接到的AWS端点的根证书的保存副本。要生成证书，首先以DER格式导出证书(有关如何执行此操作的详细信息，请参阅here)。然后运行以下命令将其转换为PEM格式：|1898382|openssl+x509+-inform+der+-in+"C:\Users\UserX\Documents\RootCert.der"+-out+RootCert.pem|1898383|如果您使用的是Powershell而不是bash，那么您需要首先安装openssl。|1898384|有关AWS+CLI支持的环境变量的完整列表，请参阅here|1898385|entityMap|0|LINK|mutability|MUTABLE|url|https://superuser.com/questions/97201/how-to-save-a-remote-server-ssl-certificate-locally-as-a-file|1|http://gnuwin32.sourceforge.net/packages/openssl.htm|2|https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html^0|F|F|12|D|0|0|1T|4|0|0|0|Y|7|1|0|P|4|2|0^^$0|@$1|2|3|4|5|6|7|14|8|@$9|15|A|16|B|C]|$9|17|A|18|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|19|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|1A|8|@]|D|@$9|1B|A|1C|1|1D]]|E|$]]|$1|M|3|N|5|H|7|1E|8|@]|D|@]|E|$I|J]]|$1|O|3|P|5|6|7|1F|8|@]|D|@$9|1G|A|1H|1|1I]]|E|$]]|$1|Q|3|R|5|6|7|1J|8|@]|D|@$9|1K|A|1L|1|1M]]|E|$]]|$1|S|3|-4|5|6|7|1N|8|@]|D|@]|E|$]]]|T|$U|$5|V|W|X|E|$Y|Z]]|10|$5|V|W|X|E|$Y|11]]|12|$5|V|W|X|E|$Y|13]]]]

If you want to use SSL and not have to specify the --no-verify-ssl option, then you need to set the AWS_CA_BUNDLE environment variable. e.g from PowerShell:

<pre><code>setx AWS_CA_BUNDLE "C:\Users\UserX\Documents\RootCert.pem"
</code></pre>

The PEM file is a saved copy of the root certificate for the AWS endpoint you are trying to connect to. To generate it, first export the certificate in DER format (For details on how to do this, see <a href="https://superuser.com/questions/97201/how-to-save-a-remote-server-ssl-certificate-locally-as-a-file">here</a>). Then run the following command to convert to the PEM format:

<pre><code>openssl x509 -inform der -in "C:\Users\UserX\Documents\RootCert.der" -out RootCert.pem
</code></pre>

If you are using Powershell and not bash, then you will need to first install <a href="http://gnuwin32.sourceforge.net/packages/openssl.htm" rel="noreferrer">openssl</a>.

For a full list of environment variables supported by the AWS CLI, see <a href="https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html" rel="noreferrer">here</a>

blocks|key|1570546|text|将此选项与cmd“--no-ssl+ssl”一起使用|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1570547|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

use this option with your cmd
"--no-verify-ssl"

blocks|key|1898223|text|不确定这是否与OP的问题有关，然而，我们的一个开发人员今天早上遇到了这个问题，原来他正在使用Fiddler+(在Windows上)来调试其他问题。停止Fiddler+(正在拦截https流量)后，该问题已解决。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1898224|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Not sure if it's related to to the OP's issue, however, one of our devs had this issue this morning, turned out he was using Fiddler (on Windows), to debug other issues. After stopping Fiddler (which was intercepting https traffic), the issue was resolved.

blocks|key|5426849|text|我在Windows10上也遇到了同样的问题，这是因为aws+cli没有从Windows注册表中读取互联网代理设置。通过将环境变量HTTP_PROXY和HTTPS_PROXY设置为公司internet代理，修复了相同的错误。希望对某些人有帮助！|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|5426850|entityMap^0|Q|7|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|K|8|@]|D|@]|E|$]]]|G|$]]

I had the same issue on Windows 10. It happens to be due to the <code>aws cli</code> not reading the internet proxy setting from the Windows registry. Fixed same error by setting the environment variables HTTP_PROXY and HTTPS_PROXY to the corporate internet proxy. Hope it helps somebody!

blocks|key|1566744|text|我的问题已经解决了：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1566745|pip+install+awscli+--force-reinstall+--upgrade|code-block|syntax|javascript|1566746|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Mine was resolved with:

<pre><code>pip install awscli --force-reinstall --upgrade
</code></pre>

blocks|key|1898330|text|我在公司/公司网络的Mac+OSX上遇到了类似的问题。如果您不知道代理URL，请从您公司的网络管理员处获取它，并使用以下命令进行配置。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1898331|Linux、macOS或Unix|1898332|$+export+HTTP_PROXY=http://proxy.example.com:1234
$+export+HTTPS_PROXY=https://proxy.example.com:1234|code-block|syntax|javascript|1898333|视窗|1898334|$+set+HTTP_PROXY=http://proxy.example.com:1234
$+set+HTTPS_PROXY=https://proxy.example.com:1234|1898335|More+information|offset|length|1898336|entityMap|0|LINK|mutability|MUTABLE|url|https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-proxy.html^0|0|0|0|0|0|0|G|0|0^^$0|@$1|2|3|4|5|6|7|Y|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Z|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|10|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|11|8|@]|9|@]|A|$]]|$1|K|3|L|5|F|7|12|8|@]|9|@]|A|$G|H]]|$1|M|3|N|5|6|7|13|8|@]|9|@$O|14|P|15|1|16]]|A|$]]|$1|Q|3|-4|5|6|7|17|8|@]|9|@]|A|$]]]|R|$S|$5|T|U|V|A|$W|X]]]]

I ran into a similar issue on Mac OSX in the company/corporate network. 
If you don't know the proxy URL Get it from your company's network administrator and configure with the following commands.

<h1>Linux, macOS, or Unix</h1>

<pre><code>$ export HTTP_PROXY=http://proxy.example.com:1234
$ export HTTPS_PROXY=https://proxy.example.com:1234
</code></pre>

<h1>Windows</h1>

<pre><code>$ set HTTP_PROXY=http://proxy.example.com:1234
$ set HTTPS_PROXY=https://proxy.example.com:1234
</code></pre>

<a href="https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-proxy.html" rel="nofollow noreferrer">More information</a>

blocks|key|1570649|text|问题很可能是由公司代理引起的。在我的例子中，我在代理服务器后面的AWS+CLI上运行命令，并收到证书错误。因此，为了解决这个问题，我添加了--no-verify-ssl标志。尽管这是一个糟糕的想法，但我将其用作临时解决方案，以便在网络团队解决问题之前完成工作。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|1570650|entityMap^0|1X|F|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|K|8|@]|D|@]|E|$]]]|G|$]]

Problem most likely caused by corporate proxy. In my case I was running the commands on AWS CLI behind proxy server and was getting certificate error. 
So to get around this I added --no-verify-ssl flag. Though this is a bad idea, I used this as a temporary solution to get the job done until it is resolved by the network team.

blocks|key|4008816|text|我相信这个选项已经尝试过了，但只是把它放在这里供每个人参考：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4008817|当您将代理添加到ec2计算机，并且代理位于连接了S3+vpc端点的私有子网中时。我也收到了同样的错误。|4008818|根据per：https://aws.amazon.com/premiumsupport/knowledge-center/connect-s3-vpc-endpoint/使用存储桶的no_proxy绕过代理|offset|length|4008819|对我没有帮助，仍然因为同样的错误而失败。|4008820|这里唯一需要注意的是，我们需要添加端点url，如下所示，它对我有效：|4008821|导出NO_PROXY=169.254.169.254，s3.ap-东南-2.amazonaws.com|4008822|在我的例子中，169.254.169.254用于访问实例角色凭证。|4008823|entityMap|0|LINK|mutability|MUTABLE|url|https://aws.amazon.com/premiumsupport/knowledge-center/connect-s3-vpc-endpoint/^0|0|0|6|27|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|X|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Y|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|Z|8|@]|9|@$F|10|G|11|1|12]]|A|$]]|$1|H|3|I|5|6|7|13|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|14|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|15|8|@]|9|@]|A|$]]|$1|N|3|O|5|6|7|16|8|@]|9|@]|A|$]]|$1|P|3|-4|5|6|7|17|8|@]|9|@]|A|$]]]|Q|$R|$5|S|T|U|A|$V|W]]]]

I believe this option would have been tried already but just putting it here for everyones reference:

when you have proxy added to your ec2 machines and it is in private subnet with a S3 vpc-endpoint attached. I was getting the same error.

Bypassing the proxy using no_proxy for the bucket as per : <a href="https://aws.amazon.com/premiumsupport/knowledge-center/connect-s3-vpc-endpoint/" rel="nofollow noreferrer">https://aws.amazon.com/premiumsupport/knowledge-center/connect-s3-vpc-endpoint/</a>

didn't help me and was still failing with the same error.

the only catch here was we need to add endpoint url which is s3.ap-southeast-2.amazonaws.com as below and it worked for me:

export NO_PROXY=169.254.169.254,s3.ap-southeast-2.amazonaws.com

169.254.169.254 is used to access instance role credentials in my case.

blocks|key|1570660|text|我遇到了类似的问题，并通过如下设置代理来解决它：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1570661|$+set+HTTP_PROXY=http://proxy.example.com:1234

$+set+HTTPS_PROXY=https://proxy.example.com:1234|code-block|syntax|javascript|1570662|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

I had a similar issue and solved it by setting the proxy as follows:

<pre><code>$ set HTTP_PROXY=http://proxy.example.com:1234

$ set HTTPS_PROXY=https://proxy.example.com:1234
</code></pre>

blocks|key|1566847|text|我将证书添加到C:\Program+Files\Amazon\AWSCLIV2\botocore\cacert.pem，它解决了问题。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1566848|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

I added the certificate to C:\Program Files\Amazon\AWSCLIV2\botocore\cacert.pem and it resolved the problem.

blocks|key|1898467|text|我的问题是我们公司的虚拟专用网络。在我断开VPN连接后，它起作用了|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1898468|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

My issue was our company's VPN. It worked after I disconnected from VPN

blocks|key|4008888|text|Linux:
$+export+AWS_CA_BUNDLE="/data/ca-certs/ca-bundle.pem"

Windows:
PS+C:\>+setx+AWS_CA_BUNDLE+C:\data\ca-certs\ca-bundle.pem

$+aws+s3+ls+--ca-bundle+"/data/ca-certs/ca-bundle.pem"|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|4008889|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code>Linux:
$ export AWS_CA_BUNDLE=&quot;/data/ca-certs/ca-bundle.pem&quot;

Windows:
PS C:\&gt; setx AWS_CA_BUNDLE C:\data\ca-certs\ca-bundle.pem

$ aws s3 ls --ca-bundle &quot;/data/ca-certs/ca-bundle.pem&quot;
</code></pre>

blocks|key|4008903|text|亚马逊网络服务已经为此发布了一个干净的解决方案，这里是:现在不是黑客攻击你的系统，而是CLI支持你向它传递一个带有CA链的.pem文件，以便它与你的代理进行通信：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4008904|https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-troubleshooting.html#tshoot-certificate-verify-failed|offset|length|4008905|4008906|要解决此问题，请使用捆绑配置文件设置、--ca-+.pem命令行选项或AWS_CA_Bundle环境变量指示AWS+CLI在何处可以找到您公司的捆绑文件。|blockquote|4008907|4008908|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|33|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|S|8|@]|9|@$D|T|E|U|1|V]]|A|$]]|$1|F|3|-4|5|6|7|W|8|@]|9|@]|A|$]]|$1|G|3|H|5|I|7|X|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]|$1|K|3|-4|5|6|7|Z|8|@]|9|@]|A|$]]]|L|$M|$5|N|O|P|A|$Q|C]]]]

AWS already posted a clean solution for this, here it is:
Instead of hacking your system now the CLI supports you passing it a .pem file with the CA chain for it to communicate with your proxy:
<a href="https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-troubleshooting.html#tshoot-certificate-verify-failed" rel="nofollow noreferrer">https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-troubleshooting.html#tshoot-certificate-verify-failed</a>
<blockquote>
To fix this, instruct the AWS CLI where to find your companies .pem file using the ca_bundle configuration file setting, --ca-bundle command line option, or the AWS_CA_Bundle environment variable.
</blockquote>

blocks|key|5427065|text|我同意上述答案，请执行以下操作|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5427066|1-删除cli并安装最新的cli|5427067|2-检查证书是否存在:+C:\Program+Files\Amazon\AWSCLIV2\botocore\cacert.pem|5427068|3-如果不存在，删除cli并转到:+C:\Program+Files\并删除Amazon|5427069|4-安装cli的最新版本，它应该可以工作。|5427070|5-尝试在连接VPN的情况下进行测试|5427071|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|P|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|Q|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|R|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|S|8|@]|9|@]|A|$]]|$1|L|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|M|$]]

I agree with above answers, do the following
1- Remove your cli and install latest cli
2- check the certificate exist: C:\Program Files\Amazon\AWSCLIV2\botocore\cacert.pem
3- if it doesn't exist remove the cli and go to: C:\Program Files\ and remove Amazon
4- Install cli latest version it should work.
5- Try testing with your VPN connected

blocks|key|5426919|text|使用以下选项来解决ssl认证问题。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5426920|aws+s3+ls+--无验证-ssl|5426921|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

use the following option to overcome the ssl certification issue.

aws s3 ls --no-verify-ssl

I installed <a href="http://docs.aws.amazon.com/cli/latest/userguide/installing.html#install-msi-on-windows" rel="noreferrer">AWS CLI</a> on the Windows server 2007 32bit.

<pre><code>aws --version
aws-cli/1.8.8 Python/2.7.9 Windows/2008Server 
</code></pre>

I configure <code>aws cli</code> using keys

Once I run below command to test AWS S3, I get this SSL error:

<pre><code>aws s3 ls
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)
</code></pre>

Please help to get rid of this basic error.

SSL CERTIFICATE_VERIFY_FAILED in aws cli

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋 

腾讯云代码助手

CODING DevOps

Cloud Studio

SDK中心

API中心

命令行工具

我在Windows server200732位上安装了。aws --versionaws-cli/1.8.8 Python/2.7.9 Windows/2008Server 我使用密钥配置aws cli一旦我运行下面的命令来测试AWS SSL，我就会得到这个S3错误：aws s3 ls[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify faile

问aws cli中的SSL CERTIFICATE_VERIFY_FAILED
EN

回答 15

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问aws cli中的SSL CERTIFICATE_VERIFY_FAILEDEN

回答 15

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问aws cli中的SSL CERTIFICATE_VERIFY_FAILED
EN