locustio/locust · error · OSError

Could not find a suitable TLS CA certificate bundle, invalid

Error message

Could not find a suitable TLS CA certificate bundle, invalid path: {cert_loc}

What it means

When `verify` is set to a path (CA bundle file or directory), locust's FastHttpUrlConnection cert_verify checks os.path.exists(cert_loc) and raises OSError if missing. This ensures TLS server verification has a real CA bundle to load. Note: the raised exception is OSError, though the message template resembles requests' SSLError wording.

Source

Thrown at locust/clients.py:505

        if self.poolmanager is None:
            super().init_poolmanager(*args, **kwargs)

    # In python requests version 2.32.5 they reverted
    # https://github.com/psf/requests/pull/6667
    # Without this change the root CA certificates are loaded on every request
    # We re-implement this change to increase the performance
    def cert_verify(self, conn, url, verify, cert):
        if requests_version < (2, 32, 5):
            return super().cert_verify(conn, url, verify, cert)

        if url.lower().startswith("https") and verify:
            conn.cert_reqs = "CERT_REQUIRED"

            if verify is not True:
                cert_loc = verify

                if not os.path.exists(cert_loc):
                    raise OSError(f"Could not find a suitable TLS CA certificate bundle, invalid path: {cert_loc}")

                if not os.path.isdir(cert_loc):
                    conn.ca_certs = cert_loc
                else:
                    conn.ca_cert_dir = cert_loc
        else:
            conn.cert_reqs = "CERT_NONE"
            conn.ca_certs = None
            conn.ca_cert_dir = None

        if cert:
            if not isinstance(cert, basestring):
                conn.cert_file = cert[0]
                conn.key_file = cert[1]
            else:
                conn.cert_file = cert
                conn.key_file = None
            if conn.cert_file and not os.path.exists(conn.cert_file):

View on GitHub (pinned to f391a716e1)

Solutions

1. Verify the CA bundle path exists: `ls -l /path/to/ca.pem` before running Locust
2. Use an absolute path for `verify`
3. On Linux set verify to the system bundle, e.g. `/etc/ssl/certs/ca-certificates.crt`, or `verify=True` to use certifi defaults
4. Mount/copy the CA file into the container or install ca-certificates

Example fix

// before
class MyUser(FastHttpUser):
    host = "https://example.com"
    # verify = "./ca.pem"  # file missing in container
// after
class MyUser(FastHttpUser):
    host = "https://example.com"
    verify = "/etc/ssl/certs/ca-certificates.crt"

import os
verify_path = "/path/to/ca.pem"
assert verify_path and os.path.exists(verify_path), f"CA bundle missing: {verify_path}"

def has_ca_bundle(path):
    return isinstance(path, str) and os.path.exists(path)

try:
    client.get(url, verify=ca_path)
except OSError as e:
    logger.error("CA bundle invalid: %s", e)

When it happens

Trigger: Passing `verify="/path/to/ca.pem"` (or a directory) to FastHttpUser/FastHttpSession requests or client config where the path does not exist on disk.

Common situations: Docker/CI images lacking the CA file mounted; relative paths resolved from a different working directory; typos in the cert path; copying configs between machines.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Could not find the TLS certificate file, invalid path: {conn
• Could not find the TLS key file, invalid path: {conn.key_fil
• You must specify the base host. Either in the host attribute
• Cannot iterate content on a response without _response attri
• If you want to change the state of the request, you must pas

AI-assisted analysis of locustio/locust@f391a716e1 (2026-08-29). Data as JSON: /api/errors/efbbae23c95f6200. Report an issue: GitHub.