{"record":{"id":"efbbae23c95f6200","repo":"locustio/locust","slug":"could-not-find-a-suitable-tls-ca-certificate-bundl","errorCode":null,"errorMessage":"Could not find a suitable TLS CA certificate bundle, invalid path: {cert_loc}","messagePattern":"Could not find a suitable TLS CA certificate bundle, invalid path: (.+?)","errorType":"exception","errorClass":"OSError","httpStatus":null,"severity":"error","filePath":"locust/clients.py","lineNumber":505,"sourceCode":"        if self.poolmanager is None:\n            super().init_poolmanager(*args, **kwargs)\n\n    # In python requests version 2.32.5 they reverted\n    # https://github.com/psf/requests/pull/6667\n    # Without this change the root CA certificates are loaded on every request\n    # We re-implement this change to increase the performance\n    def cert_verify(self, conn, url, verify, cert):\n        if requests_version < (2, 32, 5):\n            return super().cert_verify(conn, url, verify, cert)\n\n        if url.lower().startswith(\"https\") and verify:\n            conn.cert_reqs = \"CERT_REQUIRED\"\n\n            if verify is not True:\n                cert_loc = verify\n\n                if not os.path.exists(cert_loc):\n                    raise OSError(f\"Could not find a suitable TLS CA certificate bundle, invalid path: {cert_loc}\")\n\n                if not os.path.isdir(cert_loc):\n                    conn.ca_certs = cert_loc\n                else:\n                    conn.ca_cert_dir = cert_loc\n        else:\n            conn.cert_reqs = \"CERT_NONE\"\n            conn.ca_certs = None\n            conn.ca_cert_dir = None\n\n        if cert:\n            if not isinstance(cert, basestring):\n                conn.cert_file = cert[0]\n                conn.key_file = cert[1]\n            else:\n                conn.cert_file = cert\n                conn.key_file = None\n            if conn.cert_file and not os.path.exists(conn.cert_file):","sourceCodeStart":487,"sourceCodeEnd":523,"githubUrl":"https://github.com/locustio/locust/blob/f391a716e12c2c712e80b5835e877b7933397453/locust/clients.py#L487-L523","documentation":"When `verify` is set to a path (CA bundle file or directory), locust's FastHttpUrlConnection cert_verify checks os.path.exists(cert_loc) and raises OSError if missing. This ensures TLS server verification has a real CA bundle to load. Note: the raised exception is OSError, though the message template resembles requests' SSLError wording.","triggerScenarios":"Passing `verify=\"/path/to/ca.pem\"` (or a directory) to FastHttpUser/FastHttpSession requests or client config where the path does not exist on disk.","commonSituations":"Docker/CI images lacking the CA file mounted; relative paths resolved from a different working directory; typos in the cert path; copying configs between machines.","solutions":["Verify the CA bundle path exists: `ls -l /path/to/ca.pem` before running Locust","Use an absolute path for `verify`","On Linux set verify to the system bundle, e.g. `/etc/ssl/certs/ca-certificates.crt`, or `verify=True` to use certifi defaults","Mount/copy the CA file into the container or install ca-certificates"],"exampleFix":"// before\nclass MyUser(FastHttpUser):\n    host = \"https://example.com\"\n    # verify = \"./ca.pem\"  # file missing in container\n// after\nclass MyUser(FastHttpUser):\n    host = \"https://example.com\"\n    verify = \"/etc/ssl/certs/ca-certificates.crt\"","handlingStrategy":"validation","validationCode":"import os\nverify_path = \"/path/to/ca.pem\"\nassert verify_path and os.path.exists(verify_path), f\"CA bundle missing: {verify_path}\"","typeGuard":"def has_ca_bundle(path):\n    return isinstance(path, str) and os.path.exists(path)","tryCatchPattern":"try:\n    client.get(url, verify=ca_path)\nexcept OSError as e:\n    logger.error(\"CA bundle invalid: %s\", e)","preventionTips":["Use absolute paths for CA bundles","Mount certs in containers/CI images","Fall back to verify=True (certifi) when no custom CA is needed"],"tags":["tls","ssl","certificates","fasthttp"],"backgroundTag":"tls-ca-bundle-not-found","analyzedSha":"f391a716e12c2c712e80b5835e877b7933397453","analyzedAt":"2026-08-29T00:36:13.872Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}