I have a FreeBSD 10.0 system, and a couple of days ago, I upgraded my python27 port from Python 2.7.8 to Python 2.7.9, which enabled SSL verification by default. Unsurprisingly, it broke my existing Python scripts that connected to servers with self-signed certificates. Surprisingly, it broke my scripts that connected to servers with valid SSL certificates.

I have /usr/local/etc/ssl/cert.pem (which is a symlink to /usr/local/share/certs/ca-root-nss.crt) but not /etc/ssl/cert.pem. My Python installation expects the latter:

>>> ssl.get_default_verify_paths()

I've worked around this by creating an appropriate symlink, but is there a better approach? Should this be necessary, or is this something that should have been addressed by the port itself?

(And I could set SSL_CERT_FILE in my environment too, but I'd rather not have to do that all the time.)

2 Answers 2


The respective FreeBSD bug is here. The fix adds symlinks:

ln -sf /usr/local/etc/ssl/cert.pem /etc/ssl/cert.pem
ln -sf /usr/local/etc/ssl/cert.pem /usr/local/openssl/cert.pem

I had ca_root_nss which provides /usr/local/etc/ssl/cert.pem but not /etc/ssl/cert.pem needed by python 2.7.9. So I ended up linking the second one to the first one. I could not find any reference to this bug on https://bugs.freebsd.org/bugzilla/.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .