{"id":"a9cf1211ab852708","repo":"aio-libs/aiohttp","slug":"cannot-connect-to-host-host-port-ssl-ssl-c","errorCode":null,"errorMessage":"Cannot connect to host {host}:{port} ssl:{ssl} [{ClassName}: {args}]","messagePattern":"Cannot connect to host (.+?):(.+?) ssl:(.+?) \\[(.+?): (.+?)\\]","errorType":"exception","errorClass":"ClientConnectorCertificateError","httpStatus":null,"severity":"error","filePath":"aiohttp/connector.py","lineNumber":1347,"sourceCode":"            ):\n                sock = await aiohappyeyeballs.start_connection(\n                    addr_infos=addr_infos,\n                    local_addr_infos=self._local_addr_infos,\n                    happy_eyeballs_delay=self._happy_eyeballs_delay,\n                    interleave=self._interleave,\n                    loop=self._loop,\n                    socket_factory=self._socket_factory,\n                )\n                # Add ssl_shutdown_timeout for Python 3.11+ when SSL is used\n                if (\n                    kwargs.get(\"ssl\")\n                    and self._ssl_shutdown_timeout\n                    and sys.version_info >= (3, 11)\n                ):\n                    kwargs[\"ssl_shutdown_timeout\"] = self._ssl_shutdown_timeout\n                return await create_connection(self._loop, *args, **kwargs, sock=sock)\n        except cert_errors as exc:\n            raise ClientConnectorCertificateError(req.connection_key, exc) from exc\n        except ssl_errors as exc:\n            raise ClientConnectorSSLError(req.connection_key, exc) from exc\n        except OSError as exc:\n            if exc.errno is None and isinstance(exc, asyncio.TimeoutError):\n                raise\n            raise client_error(req.connection_key, exc) from exc\n\n    def _warn_about_tls_in_tls(\n        self,\n        underlying_transport: asyncio.Transport,\n        req: ClientRequest,\n    ) -> None:\n        \"\"\"Issue a warning if the requested URL has HTTPS scheme.\"\"\"\n        if req.url.scheme != \"https\":\n            return\n\n        # TLS-in-TLS only applies when the proxy itself is HTTPS.\n        # When the proxy is HTTP, start_tls upgrades a plain TCP connection,","sourceCodeStart":1329,"sourceCodeEnd":1365,"githubUrl":"https://github.com/aio-libs/aiohttp/blob/c0ef574e29109210e96e652771ae4e7b88615fa4/aiohttp/connector.py#L1329-L1365","documentation":"Raised inside _wrap_create_connection() when the underlying asyncio create_connection() raises an exception matching `cert_errors` (e.g. ssl.SSLCertVerificationError, ssl.CertificateError) during the initial direct TLS handshake. Wrapped as ClientConnectorCertificateError(req.connection_key, exc), carrying the host/port/SSL config of the failed request.","triggerScenarios":"Direct (non-proxy) HTTPS connection where the server certificate fails verification: self-signed cert, expired cert, wrong hostname, untrusted CA, or a pinned-fingerprint mismatch during the handshake.","commonSituations":"Self-signed dev/staging servers. Corporate MITM proxies with an untrusted CA. System clock skew making a valid cert look expired. Missing CA bundle on minimal containers. Hostname mismatch behind a CDN.","solutions":["Install the correct CA bundle (e.g. `certifi`, or your corporate root) into the trust store.","Provide a custom `ssl.SSLContext` with the right CA loaded: `ssl.create_default_context(cafile=...)`.","For dev only, pass `ssl=False` to disable verification (never in production).","Check system time with `date` and fix clock skew."],"exampleFix":"# before\nasync with session.get('https://self-signed.example') as r: ...\n# after (dev only)\nimport ssl\nctx = ssl.create_default_context(cadata=PEM_CERT)\n# or, dev-only bypass:\nasync with session.get('https://self-signed.example', ssl=False) as r: ...","handlingStrategy":"try-catch","validationCode":"import ssl\n\ndef trusted_context(cafile=None, cadata=None) -> ssl.SSLContext:\n    ctx = ssl.create_default_context(cafile=cafile, cadata=cadata)\n    return ctx","typeGuard":null,"tryCatchPattern":"from aiohttp import ClientConnectorCertificateError\ntry:\n    await session.get(url, ssl=ctx)\nexcept ClientConnectorCertificateError as e:\n    # e.g. install missing CA or pin fingerprint; do not blind-bypass in prod\n    raise","preventionTips":["Always build an explicit SSLContext with the right CA bundle for the deployment.","In dev, gate ssl=False behind an env var that is fatal in production.","Monitor cert expiry of internal CAs feeding your trust store."],"tags":["connector","ssl","certificate","tls","client"],"analyzedSha":"c0ef574e29109210e96e652771ae4e7b88615fa4","analyzedAt":"2026-08-04T19:51:05.467Z","schemaVersion":2}