when to remove the `certifi`/`ca-certificates` pin – `<=2025.1.31`

[jGaboardi]

Once this test in dev CI starts failing, we can remove the certifi/ca-certificates pin

• make expected failure on condition within dev for test_get_vre_tables() #105

[jGaboardi]

Still seems to be an issue – certifi/python-certifi#360

[jGaboardi]

• xref:
  • Upgrade from 2025.01.31 to 2025.4.26 broke certificate certifi/python-certifi#349
  • pip3 list | grep certifi ---> certifi 2025.7.9 meet the same ssl error like issue 349 certifi/python-certifi#360
  • trouble with certifi==2025.4.26 #97

MRE

import certifi
import requests
print(f"{certifi.__version__=}")
url = (
    "https://www2.census.gov/programs-surveys/acs/"
    "replicate_estimates/2023/data/5-year/150/B01001_01.csv.zip"
)
requests.get(url)

---

Example by version

certifi=2025.01.31 ✅

• 🍾 Succeeds 🍾

Full Traceback

Python 3.12.11 | packaged by conda-forge | (main, Jun  4 2025, 14:38:53) [Clang 18.1.8 ]
Type 'copyright', 'credits' or 'license' for more information
IPython 9.4.0 -- An enhanced Interactive Python. Type '?' for help.
Tip: Use `--theme`, or the `%colors` magic to change IPython's themes and colors.

In [1]: import certifi
   ...: import requests
   ...: 
   ...: print(f"{certifi.__version__=}")
   ...: 
   ...: url = (
   ...:     "https://www2.census.gov/programs-surveys/acs/"
   ...:     "replicate_estimates/2023/data/5-year/150/B01001_01.csv.zip"
   ...: )
   ...: 
   ...: requests.get(url)
certifi.__version__='2025.01.31'
Out[1]: <Response [200]>

certifi=2025.04.26 ❌

• 🤨 Raises 🤨 :
  • ssl.SSLError
  • ssl.SSLCertVerificationError
  • urllib3.exceptions.MaxRetryError

Full Traceback

Python 3.12.11 | packaged by conda-forge | (main, Jun  4 2025, 14:38:53) [Clang 18.1.8 ]
Type 'copyright', 'credits' or 'license' for more information
IPython 9.4.0 -- An enhanced Interactive Python. Type '?' for help.
Tip: `?` alone on a line will brings up IPython's help

In [1]: import certifi
   ...: import requests
   ...: 
   ...: print(f"{certifi.__version__=}")
   ...: 
   ...: url = (
   ...:     "https://www2.census.gov/programs-surveys/acs/"
   ...:     "replicate_estimates/2023/data/5-year/150/B01001_01.csv.zip"
   ...: )
   ...: 
   ...: requests.get(url)
certifi.__version__='2025.04.26'
---------------------------------------------------------------------------
SSLCertVerificationError                  Traceback (most recent call last)
File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connectionpool.py:464, in HTTPConnectionPool._make_request(self, conn, method, url, body, headers, retries, timeout, chunked, response_conn, preload_content, decode_content, enforce_content_length)
    463 try:
--> 464     self._validate_conn(conn)
    465 except (SocketTimeout, BaseSSLError) as e:

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connectionpool.py:1093, in HTTPSConnectionPool._validate_conn(self, conn)
   1092 if conn.is_closed:
-> 1093     conn.connect()
   1095 # TODO revise this, see https://github.com/urllib3/urllib3/issues/2791

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connection.py:790, in HTTPSConnection.connect(self)
    788 server_hostname_rm_dot = server_hostname.rstrip(".")
--> 790 sock_and_verified = _ssl_wrap_socket_and_match_hostname(
    791     sock=sock,
    792     cert_reqs=self.cert_reqs,
    793     ssl_version=self.ssl_version,
    794     ssl_minimum_version=self.ssl_minimum_version,
    795     ssl_maximum_version=self.ssl_maximum_version,
    796     ca_certs=self.ca_certs,
    797     ca_cert_dir=self.ca_cert_dir,
    798     ca_cert_data=self.ca_cert_data,
    799     cert_file=self.cert_file,
    800     key_file=self.key_file,
    801     key_password=self.key_password,
    802     server_hostname=server_hostname_rm_dot,
    803     ssl_context=self.ssl_context,
    804     tls_in_tls=tls_in_tls,
    805     assert_hostname=self.assert_hostname,
    806     assert_fingerprint=self.assert_fingerprint,
    807 )
    808 self.sock = sock_and_verified.socket

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connection.py:969, in _ssl_wrap_socket_and_match_hostname(sock, cert_reqs, ssl_version, ssl_minimum_version, ssl_maximum_version, cert_file, key_file, key_password, ca_certs, ca_cert_dir, ca_cert_data, assert_hostname, assert_fingerprint, server_hostname, ssl_context, tls_in_tls)
    967         server_hostname = normalized
--> 969 ssl_sock = ssl_wrap_socket(
    970     sock=sock,
    971     keyfile=key_file,
    972     certfile=cert_file,
    973     key_password=key_password,
    974     ca_certs=ca_certs,
    975     ca_cert_dir=ca_cert_dir,
    976     ca_cert_data=ca_cert_data,
    977     server_hostname=server_hostname,
    978     ssl_context=context,
    979     tls_in_tls=tls_in_tls,
    980 )
    982 try:

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/util/ssl_.py:480, in ssl_wrap_socket(sock, keyfile, certfile, cert_reqs, ca_certs, server_hostname, ssl_version, ciphers, ssl_context, ca_cert_dir, key_password, ca_cert_data, tls_in_tls)
    478 context.set_alpn_protocols(ALPN_PROTOCOLS)
--> 480 ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
    481 return ssl_sock

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/util/ssl_.py:524, in _ssl_wrap_socket_impl(sock, ssl_context, tls_in_tls, server_hostname)
    522     return SSLTransport(sock, ssl_context, server_hostname)
--> 524 return ssl_context.wrap_socket(sock, server_hostname=server_hostname)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/ssl.py:455, in SSLContext.wrap_socket(self, sock, server_side, do_handshake_on_connect, suppress_ragged_eofs, server_hostname, session)
    449 def wrap_socket(self, sock, server_side=False,
    450                 do_handshake_on_connect=True,
    451                 suppress_ragged_eofs=True,
    452                 server_hostname=None, session=None):
    453     # SSLSocket class handles server_hostname encoding before it calls
    454     # ctx._wrap_socket()
--> 455     return self.sslsocket_class._create(
    456         sock=sock,
    457         server_side=server_side,
    458         do_handshake_on_connect=do_handshake_on_connect,
    459         suppress_ragged_eofs=suppress_ragged_eofs,
    460         server_hostname=server_hostname,
    461         context=self,
    462         session=session
    463     )

File ~/miniforge3/envs/py312_likeness/lib/python3.12/ssl.py:1041, in SSLSocket._create(cls, sock, server_side, do_handshake_on_connect, suppress_ragged_eofs, server_hostname, context, session)
   1040                 raise ValueError("do_handshake_on_connect should not be specified for non-blocking sockets")
-> 1041             self.do_handshake()
   1042 except:

File ~/miniforge3/envs/py312_likeness/lib/python3.12/ssl.py:1319, in SSLSocket.do_handshake(self, block)
   1318         self.settimeout(None)
-> 1319     self._sslobj.do_handshake()
   1320 finally:

SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)

During handling of the above exception, another exception occurred:

SSLError                                  Traceback (most recent call last)
File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connectionpool.py:787, in HTTPConnectionPool.urlopen(self, method, url, body, headers, retries, redirect, assert_same_host, timeout, pool_timeout, release_conn, chunked, body_pos, preload_content, decode_content, **response_kw)
    786 # Make the request on the HTTPConnection object
--> 787 response = self._make_request(
    788     conn,
    789     method,
    790     url,
    791     timeout=timeout_obj,
    792     body=body,
    793     headers=headers,
    794     chunked=chunked,
    795     retries=retries,
    796     response_conn=response_conn,
    797     preload_content=preload_content,
    798     decode_content=decode_content,
    799     **response_kw,
    800 )
    802 # Everything went great!

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connectionpool.py:488, in HTTPConnectionPool._make_request(self, conn, method, url, body, headers, retries, timeout, chunked, response_conn, preload_content, decode_content, enforce_content_length)
    487         new_e = _wrap_proxy_error(new_e, conn.proxy.scheme)
--> 488     raise new_e
    490 # conn.request() calls http.client.*.request, not the method in
    491 # urllib3.request. It also calls makefile (recv) on the socket.

SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)

The above exception was the direct cause of the following exception:

MaxRetryError                             Traceback (most recent call last)
File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/requests/adapters.py:667, in HTTPAdapter.send(self, request, stream, timeout, verify, cert, proxies)
    666 try:
--> 667     resp = conn.urlopen(
    668         method=request.method,
    669         url=url,
    670         body=request.body,
    671         headers=request.headers,
    672         redirect=False,
    673         assert_same_host=False,
    674         preload_content=False,
    675         decode_content=False,
    676         retries=self.max_retries,
    677         timeout=timeout,
    678         chunked=chunked,
    679     )
    681 except (ProtocolError, OSError) as err:

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connectionpool.py:841, in HTTPConnectionPool.urlopen(self, method, url, body, headers, retries, redirect, assert_same_host, timeout, pool_timeout, release_conn, chunked, body_pos, preload_content, decode_content, **response_kw)
    839     new_e = ProtocolError("Connection aborted.", new_e)
--> 841 retries = retries.increment(
    842     method, url, error=new_e, _pool=self, _stacktrace=sys.exc_info()[2]
    843 )
    844 retries.sleep()

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/util/retry.py:519, in Retry.increment(self, method, url, response, error, _pool, _stacktrace)
    518     reason = error or ResponseError(cause)
--> 519     raise MaxRetryError(_pool, url, reason) from reason  # type: ignore[arg-type]
    521 log.debug("Incremented Retry for (url='%s'): %r", url, new_retry)

MaxRetryError: HTTPSConnectionPool(host='www2.census.gov', port=443): Max retries exceeded with url: /programs-surveys/acs/replicate_estimates/2023/data/5-year/150/B01001_01.csv.zip (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)')))

During handling of the above exception, another exception occurred:

SSLError                                  Traceback (most recent call last)
Cell In[1], line 11
      4 print(f"{certifi.__version__=}")
      6 url = (
      7     "https://www2.census.gov/programs-surveys/acs/"
      8     "replicate_estimates/2023/data/5-year/150/B01001_01.csv.zip"
      9 )
---> 11 requests.get(url)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/requests/api.py:73, in get(url, params, **kwargs)
     62 def get(url, params=None, **kwargs):
     63     r"""Sends a GET request.
     64 
     65     :param url: URL for the new :class:`Request` object.
   (...)     70     :rtype: requests.Response
     71     """
---> 73     return request("get", url, params=params, **kwargs)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/requests/api.py:59, in request(method, url, **kwargs)
     55 # By using the 'with' statement we are sure the session is closed, thus we
     56 # avoid leaving sockets open which can trigger a ResourceWarning in some
     57 # cases, and look like a memory leak in others.
     58 with sessions.Session() as session:
---> 59     return session.request(method=method, url=url, **kwargs)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/requests/sessions.py:589, in Session.request(self, method, url, params, data, headers, cookies, files, auth, timeout, allow_redirects, proxies, hooks, stream, verify, cert, json)
    584 send_kwargs = {
    585     "timeout": timeout,
    586     "allow_redirects": allow_redirects,
    587 }
    588 send_kwargs.update(settings)
--> 589 resp = self.send(prep, **send_kwargs)
    591 return resp

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/requests/sessions.py:703, in Session.send(self, request, **kwargs)
    700 start = preferred_clock()
    702 # Send the request
--> 703 r = adapter.send(request, **kwargs)
    705 # Total elapsed time of the request (approximately)
    706 elapsed = preferred_clock() - start

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/requests/adapters.py:698, in HTTPAdapter.send(self, request, stream, timeout, verify, cert, proxies)
    694         raise ProxyError(e, request=request)
    696     if isinstance(e.reason, _SSLError):
    697         # This branch is for urllib3 v1.22 and later.
--> 698         raise SSLError(e, request=request)
    700     raise ConnectionError(e, request=request)
    702 except ClosedPoolError as e:

SSLError: HTTPSConnectionPool(host='www2.census.gov', port=443): Max retries exceeded with url: /programs-surveys/acs/replicate_estimates/2023/data/5-year/150/B01001_01.csv.zip (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)')))

certifi=2025.06.15 ❌

• 🤨 Raises 🤨 :
  • ssl.SSLError
  • ssl.SSLCertVerificationError
  • urllib3.exceptions.MaxRetryError

Full Traceback

Python 3.12.11 | packaged by conda-forge | (main, Jun  4 2025, 14:38:53) [Clang 18.1.8 ]
Type 'copyright', 'credits' or 'license' for more information
IPython 9.4.0 -- An enhanced Interactive Python. Type '?' for help.
Tip: `?` alone on a line will brings up IPython's help

In [1]: import certifi
   ...: import requests
   ...: 
   ...: print(f"{certifi.__version__=}")
   ...: 
   ...: url = (
   ...:     "https://www2.census.gov/programs-surveys/acs/"
   ...:     "replicate_estimates/2023/data/5-year/150/B01001_01.csv.zip"
   ...: )
   ...: 
   ...: requests.get(url)
certifi.__version__='2025.06.15'
---------------------------------------------------------------------------
SSLCertVerificationError                  Traceback (most recent call last)
File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connectionpool.py:464, in HTTPConnectionPool._make_request(self, conn, method, url, body, headers, retries, timeout, chunked, response_conn, preload_content, decode_content, enforce_content_length)
    463 try:
--> 464     self._validate_conn(conn)
    465 except (SocketTimeout, BaseSSLError) as e:

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connectionpool.py:1093, in HTTPSConnectionPool._validate_conn(self, conn)
   1092 if conn.is_closed:
-> 1093     conn.connect()
   1095 # TODO revise this, see https://github.com/urllib3/urllib3/issues/2791

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connection.py:790, in HTTPSConnection.connect(self)
    788 server_hostname_rm_dot = server_hostname.rstrip(".")
--> 790 sock_and_verified = _ssl_wrap_socket_and_match_hostname(
    791     sock=sock,
    792     cert_reqs=self.cert_reqs,
    793     ssl_version=self.ssl_version,
    794     ssl_minimum_version=self.ssl_minimum_version,
    795     ssl_maximum_version=self.ssl_maximum_version,
    796     ca_certs=self.ca_certs,
    797     ca_cert_dir=self.ca_cert_dir,
    798     ca_cert_data=self.ca_cert_data,
    799     cert_file=self.cert_file,
    800     key_file=self.key_file,
    801     key_password=self.key_password,
    802     server_hostname=server_hostname_rm_dot,
    803     ssl_context=self.ssl_context,
    804     tls_in_tls=tls_in_tls,
    805     assert_hostname=self.assert_hostname,
    806     assert_fingerprint=self.assert_fingerprint,
    807 )
    808 self.sock = sock_and_verified.socket

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connection.py:969, in _ssl_wrap_socket_and_match_hostname(sock, cert_reqs, ssl_version, ssl_minimum_version, ssl_maximum_version, cert_file, key_file, key_password, ca_certs, ca_cert_dir, ca_cert_data, assert_hostname, assert_fingerprint, server_hostname, ssl_context, tls_in_tls)
    967         server_hostname = normalized
--> 969 ssl_sock = ssl_wrap_socket(
    970     sock=sock,
    971     keyfile=key_file,
    972     certfile=cert_file,
    973     key_password=key_password,
    974     ca_certs=ca_certs,
    975     ca_cert_dir=ca_cert_dir,
    976     ca_cert_data=ca_cert_data,
    977     server_hostname=server_hostname,
    978     ssl_context=context,
    979     tls_in_tls=tls_in_tls,
    980 )
    982 try:

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/util/ssl_.py:480, in ssl_wrap_socket(sock, keyfile, certfile, cert_reqs, ca_certs, server_hostname, ssl_version, ciphers, ssl_context, ca_cert_dir, key_password, ca_cert_data, tls_in_tls)
    478 context.set_alpn_protocols(ALPN_PROTOCOLS)
--> 480 ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
    481 return ssl_sock

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/util/ssl_.py:524, in _ssl_wrap_socket_impl(sock, ssl_context, tls_in_tls, server_hostname)
    522     return SSLTransport(sock, ssl_context, server_hostname)
--> 524 return ssl_context.wrap_socket(sock, server_hostname=server_hostname)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/ssl.py:455, in SSLContext.wrap_socket(self, sock, server_side, do_handshake_on_connect, suppress_ragged_eofs, server_hostname, session)
    449 def wrap_socket(self, sock, server_side=False,
    450                 do_handshake_on_connect=True,
    451                 suppress_ragged_eofs=True,
    452                 server_hostname=None, session=None):
    453     # SSLSocket class handles server_hostname encoding before it calls
    454     # ctx._wrap_socket()
--> 455     return self.sslsocket_class._create(
    456         sock=sock,
    457         server_side=server_side,
    458         do_handshake_on_connect=do_handshake_on_connect,
    459         suppress_ragged_eofs=suppress_ragged_eofs,
    460         server_hostname=server_hostname,
    461         context=self,
    462         session=session
    463     )

File ~/miniforge3/envs/py312_likeness/lib/python3.12/ssl.py:1041, in SSLSocket._create(cls, sock, server_side, do_handshake_on_connect, suppress_ragged_eofs, server_hostname, context, session)
   1040                 raise ValueError("do_handshake_on_connect should not be specified for non-blocking sockets")
-> 1041             self.do_handshake()
   1042 except:

File ~/miniforge3/envs/py312_likeness/lib/python3.12/ssl.py:1319, in SSLSocket.do_handshake(self, block)
   1318         self.settimeout(None)
-> 1319     self._sslobj.do_handshake()
   1320 finally:

SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)

During handling of the above exception, another exception occurred:

SSLError                                  Traceback (most recent call last)
File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connectionpool.py:787, in HTTPConnectionPool.urlopen(self, method, url, body, headers, retries, redirect, assert_same_host, timeout, pool_timeout, release_conn, chunked, body_pos, preload_content, decode_content, **response_kw)
    786 # Make the request on the HTTPConnection object
--> 787 response = self._make_request(
    788     conn,
    789     method,
    790     url,
    791     timeout=timeout_obj,
    792     body=body,
    793     headers=headers,
    794     chunked=chunked,
    795     retries=retries,
    796     response_conn=response_conn,
    797     preload_content=preload_content,
    798     decode_content=decode_content,
    799     **response_kw,
    800 )
    802 # Everything went great!

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connectionpool.py:488, in HTTPConnectionPool._make_request(self, conn, method, url, body, headers, retries, timeout, chunked, response_conn, preload_content, decode_content, enforce_content_length)
    487         new_e = _wrap_proxy_error(new_e, conn.proxy.scheme)
--> 488     raise new_e
    490 # conn.request() calls http.client.*.request, not the method in
    491 # urllib3.request. It also calls makefile (recv) on the socket.

SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)

The above exception was the direct cause of the following exception:

MaxRetryError                             Traceback (most recent call last)
File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/requests/adapters.py:667, in HTTPAdapter.send(self, request, stream, timeout, verify, cert, proxies)
    666 try:
--> 667     resp = conn.urlopen(
    668         method=request.method,
    669         url=url,
    670         body=request.body,
    671         headers=request.headers,
    672         redirect=False,
    673         assert_same_host=False,
    674         preload_content=False,
    675         decode_content=False,
    676         retries=self.max_retries,
    677         timeout=timeout,
    678         chunked=chunked,
    679     )
    681 except (ProtocolError, OSError) as err:

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connectionpool.py:841, in HTTPConnectionPool.urlopen(self, method, url, body, headers, retries, redirect, assert_same_host, timeout, pool_timeout, release_conn, chunked, body_pos, preload_content, decode_content, **response_kw)
    839     new_e = ProtocolError("Connection aborted.", new_e)
--> 841 retries = retries.increment(
    842     method, url, error=new_e, _pool=self, _stacktrace=sys.exc_info()[2]
    843 )
    844 retries.sleep()

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/util/retry.py:519, in Retry.increment(self, method, url, response, error, _pool, _stacktrace)
    518     reason = error or ResponseError(cause)
--> 519     raise MaxRetryError(_pool, url, reason) from reason  # type: ignore[arg-type]
    521 log.debug("Incremented Retry for (url='%s'): %r", url, new_retry)

MaxRetryError: HTTPSConnectionPool(host='www2.census.gov', port=443): Max retries exceeded with url: /programs-surveys/acs/replicate_estimates/2023/data/5-year/150/B01001_01.csv.zip (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)')))

During handling of the above exception, another exception occurred:

SSLError                                  Traceback (most recent call last)
Cell In[1], line 11
      4 print(f"{certifi.__version__=}")
      6 url = (
      7     "https://www2.census.gov/programs-surveys/acs/"
      8     "replicate_estimates/2023/data/5-year/150/B01001_01.csv.zip"
      9 )
---> 11 requests.get(url)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/requests/api.py:73, in get(url, params, **kwargs)
     62 def get(url, params=None, **kwargs):
     63     r"""Sends a GET request.
     64 
     65     :param url: URL for the new :class:`Request` object.
   (...)     70     :rtype: requests.Response
     71     """
---> 73     return request("get", url, params=params, **kwargs)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/requests/api.py:59, in request(method, url, **kwargs)
     55 # By using the 'with' statement we are sure the session is closed, thus we
     56 # avoid leaving sockets open which can trigger a ResourceWarning in some
     57 # cases, and look like a memory leak in others.
     58 with sessions.Session() as session:
---> 59     return session.request(method=method, url=url, **kwargs)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/requests/sessions.py:589, in Session.request(self, method, url, params, data, headers, cookies, files, auth, timeout, allow_redirects, proxies, hooks, stream, verify, cert, json)
    584 send_kwargs = {
    585     "timeout": timeout,
    586     "allow_redirects": allow_redirects,
    587 }
    588 send_kwargs.update(settings)
--> 589 resp = self.send(prep, **send_kwargs)
    591 return resp

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/requests/sessions.py:703, in Session.send(self, request, **kwargs)
    700 start = preferred_clock()
    702 # Send the request
--> 703 r = adapter.send(request, **kwargs)
    705 # Total elapsed time of the request (approximately)
    706 elapsed = preferred_clock() - start

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/requests/adapters.py:698, in HTTPAdapter.send(self, request, stream, timeout, verify, cert, proxies)
    694         raise ProxyError(e, request=request)
    696     if isinstance(e.reason, _SSLError):
    697         # This branch is for urllib3 v1.22 and later.
--> 698         raise SSLError(e, request=request)
    700     raise ConnectionError(e, request=request)
    702 except ClosedPoolError as e:

SSLError: HTTPSConnectionPool(host='www2.census.gov', port=443): Max retries exceeded with url: /programs-surveys/acs/replicate_estimates/2023/data/5-year/150/B01001_01.csv.zip (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)')))

certifi=2025.07.14 ❌

• 🤨 Raises 🤨 :
  • ssl.SSLError
  • ssl.SSLCertVerificationError
  • urllib3.exceptions.MaxRetryError

Full Traceback

Python 3.12.11 | packaged by conda-forge | (main, Jun  4 2025, 14:38:53) [Clang 18.1.8 ]
Type 'copyright', 'credits' or 'license' for more information
IPython 9.4.0 -- An enhanced Interactive Python. Type '?' for help.
Tip: Use `object?` to see the help on `object`, `object??` to view its source

In [1]: import certifi
   ...: import requests
   ...: 
   ...: print(f"{certifi.__version__=}")
   ...: 
   ...: url = (
   ...:     "https://www2.census.gov/programs-surveys/acs/"
   ...:     "replicate_estimates/2023/data/5-year/150/B01001_01.csv.zip"
   ...: )
   ...: 
   ...: requests.get(url)
certifi.__version__='2025.07.14'
---------------------------------------------------------------------------
SSLCertVerificationError                  Traceback (most recent call last)
File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connectionpool.py:464, in HTTPConnectionPool._make_request(self, conn, method, url, body, headers, retries, timeout, chunked, response_conn, preload_content, decode_content, enforce_content_length)
    463 try:
--> 464     self._validate_conn(conn)
    465 except (SocketTimeout, BaseSSLError) as e:

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connectionpool.py:1093, in HTTPSConnectionPool._validate_conn(self, conn)
   1092 if conn.is_closed:
-> 1093     conn.connect()
   1095 # TODO revise this, see https://github.com/urllib3/urllib3/issues/2791

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connection.py:790, in HTTPSConnection.connect(self)
    788 server_hostname_rm_dot = server_hostname.rstrip(".")
--> 790 sock_and_verified = _ssl_wrap_socket_and_match_hostname(
    791     sock=sock,
    792     cert_reqs=self.cert_reqs,
    793     ssl_version=self.ssl_version,
    794     ssl_minimum_version=self.ssl_minimum_version,
    795     ssl_maximum_version=self.ssl_maximum_version,
    796     ca_certs=self.ca_certs,
    797     ca_cert_dir=self.ca_cert_dir,
    798     ca_cert_data=self.ca_cert_data,
    799     cert_file=self.cert_file,
    800     key_file=self.key_file,
    801     key_password=self.key_password,
    802     server_hostname=server_hostname_rm_dot,
    803     ssl_context=self.ssl_context,
    804     tls_in_tls=tls_in_tls,
    805     assert_hostname=self.assert_hostname,
    806     assert_fingerprint=self.assert_fingerprint,
    807 )
    808 self.sock = sock_and_verified.socket

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connection.py:969, in _ssl_wrap_socket_and_match_hostname(sock, cert_reqs, ssl_version, ssl_minimum_version, ssl_maximum_version, cert_file, key_file, key_password, ca_certs, ca_cert_dir, ca_cert_data, assert_hostname, assert_fingerprint, server_hostname, ssl_context, tls_in_tls)
    967         server_hostname = normalized
--> 969 ssl_sock = ssl_wrap_socket(
    970     sock=sock,
    971     keyfile=key_file,
    972     certfile=cert_file,
    973     key_password=key_password,
    974     ca_certs=ca_certs,
    975     ca_cert_dir=ca_cert_dir,
    976     ca_cert_data=ca_cert_data,
    977     server_hostname=server_hostname,
    978     ssl_context=context,
    979     tls_in_tls=tls_in_tls,
    980 )
    982 try:

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/util/ssl_.py:480, in ssl_wrap_socket(sock, keyfile, certfile, cert_reqs, ca_certs, server_hostname, ssl_version, ciphers, ssl_context, ca_cert_dir, key_password, ca_cert_data, tls_in_tls)
    478 context.set_alpn_protocols(ALPN_PROTOCOLS)
--> 480 ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
    481 return ssl_sock

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/util/ssl_.py:524, in _ssl_wrap_socket_impl(sock, ssl_context, tls_in_tls, server_hostname)
    522     return SSLTransport(sock, ssl_context, server_hostname)
--> 524 return ssl_context.wrap_socket(sock, server_hostname=server_hostname)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/ssl.py:455, in SSLContext.wrap_socket(self, sock, server_side, do_handshake_on_connect, suppress_ragged_eofs, server_hostname, session)
    449 def wrap_socket(self, sock, server_side=False,
    450                 do_handshake_on_connect=True,
    451                 suppress_ragged_eofs=True,
    452                 server_hostname=None, session=None):
    453     # SSLSocket class handles server_hostname encoding before it calls
    454     # ctx._wrap_socket()
--> 455     return self.sslsocket_class._create(
    456         sock=sock,
    457         server_side=server_side,
    458         do_handshake_on_connect=do_handshake_on_connect,
    459         suppress_ragged_eofs=suppress_ragged_eofs,
    460         server_hostname=server_hostname,
    461         context=self,
    462         session=session
    463     )

File ~/miniforge3/envs/py312_likeness/lib/python3.12/ssl.py:1041, in SSLSocket._create(cls, sock, server_side, do_handshake_on_connect, suppress_ragged_eofs, server_hostname, context, session)
   1040                 raise ValueError("do_handshake_on_connect should not be specified for non-blocking sockets")
-> 1041             self.do_handshake()
   1042 except:

File ~/miniforge3/envs/py312_likeness/lib/python3.12/ssl.py:1319, in SSLSocket.do_handshake(self, block)
   1318         self.settimeout(None)
-> 1319     self._sslobj.do_handshake()
   1320 finally:

SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)

During handling of the above exception, another exception occurred:

SSLError                                  Traceback (most recent call last)
File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connectionpool.py:787, in HTTPConnectionPool.urlopen(self, method, url, body, headers, retries, redirect, assert_same_host, timeout, pool_timeout, release_conn, chunked, body_pos, preload_content, decode_content, **response_kw)
    786 # Make the request on the HTTPConnection object
--> 787 response = self._make_request(
    788     conn,
    789     method,
    790     url,
    791     timeout=timeout_obj,
    792     body=body,
    793     headers=headers,
    794     chunked=chunked,
    795     retries=retries,
    796     response_conn=response_conn,
    797     preload_content=preload_content,
    798     decode_content=decode_content,
    799     **response_kw,
    800 )
    802 # Everything went great!

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connectionpool.py:488, in HTTPConnectionPool._make_request(self, conn, method, url, body, headers, retries, timeout, chunked, response_conn, preload_content, decode_content, enforce_content_length)
    487         new_e = _wrap_proxy_error(new_e, conn.proxy.scheme)
--> 488     raise new_e
    490 # conn.request() calls http.client.*.request, not the method in
    491 # urllib3.request. It also calls makefile (recv) on the socket.

SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)

The above exception was the direct cause of the following exception:

MaxRetryError                             Traceback (most recent call last)
File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/requests/adapters.py:667, in HTTPAdapter.send(self, request, stream, timeout, verify, cert, proxies)
    666 try:
--> 667     resp = conn.urlopen(
    668         method=request.method,
    669         url=url,
    670         body=request.body,
    671         headers=request.headers,
    672         redirect=False,
    673         assert_same_host=False,
    674         preload_content=False,
    675         decode_content=False,
    676         retries=self.max_retries,
    677         timeout=timeout,
    678         chunked=chunked,
    679     )
    681 except (ProtocolError, OSError) as err:

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/connectionpool.py:841, in HTTPConnectionPool.urlopen(self, method, url, body, headers, retries, redirect, assert_same_host, timeout, pool_timeout, release_conn, chunked, body_pos, preload_content, decode_content, **response_kw)
    839     new_e = ProtocolError("Connection aborted.", new_e)
--> 841 retries = retries.increment(
    842     method, url, error=new_e, _pool=self, _stacktrace=sys.exc_info()[2]
    843 )
    844 retries.sleep()

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/urllib3/util/retry.py:519, in Retry.increment(self, method, url, response, error, _pool, _stacktrace)
    518     reason = error or ResponseError(cause)
--> 519     raise MaxRetryError(_pool, url, reason) from reason  # type: ignore[arg-type]
    521 log.debug("Incremented Retry for (url='%s'): %r", url, new_retry)

MaxRetryError: HTTPSConnectionPool(host='www2.census.gov', port=443): Max retries exceeded with url: /programs-surveys/acs/replicate_estimates/2023/data/5-year/150/B01001_01.csv.zip (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)')))

During handling of the above exception, another exception occurred:

SSLError                                  Traceback (most recent call last)
Cell In[1], line 11
      4 print(f"{certifi.__version__=}")
      6 url = (
      7     "https://www2.census.gov/programs-surveys/acs/"
      8     "replicate_estimates/2023/data/5-year/150/B01001_01.csv.zip"
      9 )
---> 11 requests.get(url)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/requests/api.py:73, in get(url, params, **kwargs)
     62 def get(url, params=None, **kwargs):
     63     r"""Sends a GET request.
     64 
     65     :param url: URL for the new :class:`Request` object.
   (...)     70     :rtype: requests.Response
     71     """
---> 73     return request("get", url, params=params, **kwargs)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/requests/api.py:59, in request(method, url, **kwargs)
     55 # By using the 'with' statement we are sure the session is closed, thus we
     56 # avoid leaving sockets open which can trigger a ResourceWarning in some
     57 # cases, and look like a memory leak in others.
     58 with sessions.Session() as session:
---> 59     return session.request(method=method, url=url, **kwargs)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/requests/sessions.py:589, in Session.request(self, method, url, params, data, headers, cookies, files, auth, timeout, allow_redirects, proxies, hooks, stream, verify, cert, json)
    584 send_kwargs = {
    585     "timeout": timeout,
    586     "allow_redirects": allow_redirects,
    587 }
    588 send_kwargs.update(settings)
--> 589 resp = self.send(prep, **send_kwargs)
    591 return resp

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/requests/sessions.py:703, in Session.send(self, request, **kwargs)
    700 start = preferred_clock()
    702 # Send the request
--> 703 r = adapter.send(request, **kwargs)
    705 # Total elapsed time of the request (approximately)
    706 elapsed = preferred_clock() - start

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/requests/adapters.py:698, in HTTPAdapter.send(self, request, stream, timeout, verify, cert, proxies)
    694         raise ProxyError(e, request=request)
    696     if isinstance(e.reason, _SSLError):
    697         # This branch is for urllib3 v1.22 and later.
--> 698         raise SSLError(e, request=request)
    700     raise ConnectionError(e, request=request)
    702 except ClosedPoolError as e:

SSLError: HTTPSConnectionPool(host='www2.census.gov', port=443): Max retries exceeded with url: /programs-surveys/acs/replicate_estimates/2023/data/5-year/150/B01001_01.csv.zip (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)')))

With pandas (our case)

import subprocess
import pandas
subprocess_kws = {"capture_output": True, "text": True, "check": True}
captured = subprocess.run(["conda", "list", "ca-certificates"], **subprocess_kws)
print(captured.stdout)
url = (
    "https://www2.census.gov/programs-surveys/acs/"
    "replicate_estimates/2023/data/5-year/150/B01001_01.csv.zip"
)
ext = pandas.read_csv(url)
ext.head()

---

Example by version

ca-certificates=2025.01.31 ✅

• 🍾 Succeeds 🍾

Full Traceback

Python 3.12.11 | packaged by conda-forge | (main, Jun  4 2025, 14:38:53) [Clang 18.1.8 ]
Type 'copyright', 'credits' or 'license' for more information
IPython 9.4.0 -- An enhanced Interactive Python. Type '?' for help.
Tip: Put a ';' at the end of a line to suppress the printing of output.

In [1]: import subprocess
   ...: import pandas
   ...: subprocess_kws = {"capture_output": True, "text": True, "check": True}
   ...: captured = subprocess.run(["conda", "list", "ca-certificates"], **subprocess_kws)
   ...: print(captured.stdout)
   ...: url = (
   ...:     "https://www2.census.gov/programs-surveys/acs/"
   ...:     "replicate_estimates/2023/data/5-year/150/B01001_01.csv.zip"
   ...: )
   ...: ext = pandas.read_csv(url)
   ...: ext.head()
# packages in environment at ~/miniforge3/envs/py312_likeness:
#
# Name                     Version          Build            Channel
ca-certificates            2025.1.31        hbd8a1cb_1       conda-forge

Out[1]: 
    TBLID                  GEOID                                               NAME  ORDER  ... Var_Rep77  Var_Rep78  Var_Rep79 Var_Rep80
0  B01001                    NaN                                                NaN    NaN  ...       NaN        NaN        NaN       NaN
1  B01001                    NaN                                                NaN    NaN  ...       NaN        NaN        NaN       NaN
2  B01001  1500000US010010201001  Block Group 1, Census Tract 201, Autauga Count...    1.0  ...     517.0      619.0      578.0     552.0
3  B01001  1500000US010010201001  Block Group 1, Census Tract 201, Autauga Count...    2.0  ...     277.0      330.0      300.0     303.0
4  B01001  1500000US010010201001  Block Group 1, Census Tract 201, Autauga Count...    3.0  ...      15.0       13.0       24.0       9.0

[5 rows x 89 columns]

ca-certificates=2025.07.14 ❌

• 🤨 Raises 🤨 :
  • URLError
  • ssl.SSLCertVerificationError

Full Traceback

Python 3.12.11 | packaged by conda-forge | (main, Jun  4 2025, 14:38:53) [Clang 18.1.8 ]
Type 'copyright', 'credits' or 'license' for more information
IPython 9.4.0 -- An enhanced Interactive Python. Type '?' for help.
Tip: You can use `files = !ls *.png`

In [1]: import subprocess
   ...: import pandas
   ...: subprocess_kws = {"capture_output": True, "text": True, "check": True}
   ...: captured = subprocess.run(["conda", "list", "ca-certificates"], **subprocess_kws)
   ...: print(captured.stdout)
   ...: url = (
   ...:     "https://www2.census.gov/programs-surveys/acs/"
   ...:     "replicate_estimates/2023/data/5-year/150/B01001_01.csv.zip"
   ...: )
   ...: ext = pandas.read_csv(url)
   ...: ext.head()
# packages in environment at ~/miniforge3/envs/py312_likeness:
#
# Name                     Version          Build            Channel
ca-certificates            2025.7.14        hbd8a1cb_0       conda-forge

---------------------------------------------------------------------------
SSLCertVerificationError                  Traceback (most recent call last)
File ~/miniforge3/envs/py312_likeness/lib/python3.12/urllib/request.py:1344, in AbstractHTTPHandler.do_open(self, http_class, req, **http_conn_args)
   1343 try:
-> 1344     h.request(req.get_method(), req.selector, req.data, headers,
   1345               encode_chunked=req.has_header('Transfer-encoding'))
   1346 except OSError as err: # timeout error

File ~/miniforge3/envs/py312_likeness/lib/python3.12/http/client.py:1338, in HTTPConnection.request(self, method, url, body, headers, encode_chunked)
   1337 """Send a complete request to the server."""
-> 1338 self._send_request(method, url, body, headers, encode_chunked)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/http/client.py:1384, in HTTPConnection._send_request(self, method, url, body, headers, encode_chunked)
   1383     body = _encode(body, 'body')
-> 1384 self.endheaders(body, encode_chunked=encode_chunked)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/http/client.py:1333, in HTTPConnection.endheaders(self, message_body, encode_chunked)
   1332     raise CannotSendHeader()
-> 1333 self._send_output(message_body, encode_chunked=encode_chunked)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/http/client.py:1093, in HTTPConnection._send_output(self, message_body, encode_chunked)
   1092 del self._buffer[:]
-> 1093 self.send(msg)
   1095 if message_body is not None:
   1096 
   1097     # create a consistent interface to message_body

File ~/miniforge3/envs/py312_likeness/lib/python3.12/http/client.py:1037, in HTTPConnection.send(self, data)
   1036 if self.auto_open:
-> 1037     self.connect()
   1038 else:

File ~/miniforge3/envs/py312_likeness/lib/python3.12/http/client.py:1479, in HTTPSConnection.connect(self)
   1477     server_hostname = self.host
-> 1479 self.sock = self._context.wrap_socket(self.sock,
   1480                                       server_hostname=server_hostname)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/ssl.py:455, in SSLContext.wrap_socket(self, sock, server_side, do_handshake_on_connect, suppress_ragged_eofs, server_hostname, session)
    449 def wrap_socket(self, sock, server_side=False,
    450                 do_handshake_on_connect=True,
    451                 suppress_ragged_eofs=True,
    452                 server_hostname=None, session=None):
    453     # SSLSocket class handles server_hostname encoding before it calls
    454     # ctx._wrap_socket()
--> 455     return self.sslsocket_class._create(
    456         sock=sock,
    457         server_side=server_side,
    458         do_handshake_on_connect=do_handshake_on_connect,
    459         suppress_ragged_eofs=suppress_ragged_eofs,
    460         server_hostname=server_hostname,
    461         context=self,
    462         session=session
    463     )

File ~/miniforge3/envs/py312_likeness/lib/python3.12/ssl.py:1041, in SSLSocket._create(cls, sock, server_side, do_handshake_on_connect, suppress_ragged_eofs, server_hostname, context, session)
   1040                 raise ValueError("do_handshake_on_connect should not be specified for non-blocking sockets")
-> 1041             self.do_handshake()
   1042 except:

File ~/miniforge3/envs/py312_likeness/lib/python3.12/ssl.py:1319, in SSLSocket.do_handshake(self, block)
   1318         self.settimeout(None)
-> 1319     self._sslobj.do_handshake()
   1320 finally:

SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)

During handling of the above exception, another exception occurred:

URLError                                  Traceback (most recent call last)
Cell In[1], line 10
      5 print(captured.stdout)
      6 url = (
      7     "https://www2.census.gov/programs-surveys/acs/"
      8     "replicate_estimates/2023/data/5-year/150/B01001_01.csv.zip"
      9 )
---> 10 ext = pandas.read_csv(url)
     11 ext.head()

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/pandas/io/parsers/readers.py:1026, in read_csv(filepath_or_buffer, sep, delimiter, header, names, index_col, usecols, dtype, engine, converters, true_values, false_values, skipinitialspace, skiprows, skipfooter, nrows, na_values, keep_default_na, na_filter, verbose, skip_blank_lines, parse_dates, infer_datetime_format, keep_date_col, date_parser, date_format, dayfirst, cache_dates, iterator, chunksize, compression, thousands, decimal, lineterminator, quotechar, quoting, doublequote, escapechar, comment, encoding, encoding_errors, dialect, on_bad_lines, delim_whitespace, low_memory, memory_map, float_precision, storage_options, dtype_backend)
   1013 kwds_defaults = _refine_defaults_read(
   1014     dialect,
   1015     delimiter,
   (...)   1022     dtype_backend=dtype_backend,
   1023 )
   1024 kwds.update(kwds_defaults)
-> 1026 return _read(filepath_or_buffer, kwds)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/pandas/io/parsers/readers.py:620, in _read(filepath_or_buffer, kwds)
    617 _validate_names(kwds.get("names", None))
    619 # Create the parser.
--> 620 parser = TextFileReader(filepath_or_buffer, **kwds)
    622 if chunksize or iterator:
    623     return parser

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/pandas/io/parsers/readers.py:1620, in TextFileReader.__init__(self, f, engine, **kwds)
   1617     self.options["has_index_names"] = kwds["has_index_names"]
   1619 self.handles: IOHandles | None = None
-> 1620 self._engine = self._make_engine(f, self.engine)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/pandas/io/parsers/readers.py:1880, in TextFileReader._make_engine(self, f, engine)
   1878     if "b" not in mode:
   1879         mode += "b"
-> 1880 self.handles = get_handle(
   1881     f,
   1882     mode,
   1883     encoding=self.options.get("encoding", None),
   1884     compression=self.options.get("compression", None),
   1885     memory_map=self.options.get("memory_map", False),
   1886     is_text=is_text,
   1887     errors=self.options.get("encoding_errors", "strict"),
   1888     storage_options=self.options.get("storage_options", None),
   1889 )
   1890 assert self.handles is not None
   1891 f = self.handles.handle

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/pandas/io/common.py:728, in get_handle(path_or_buf, mode, encoding, compression, memory_map, is_text, errors, storage_options)
    725     codecs.lookup_error(errors)
    727 # open URLs
--> 728 ioargs = _get_filepath_or_buffer(
    729     path_or_buf,
    730     encoding=encoding,
    731     compression=compression,
    732     mode=mode,
    733     storage_options=storage_options,
    734 )
    736 handle = ioargs.filepath_or_buffer
    737 handles: list[BaseBuffer]

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/pandas/io/common.py:384, in _get_filepath_or_buffer(filepath_or_buffer, encoding, compression, mode, storage_options)
    382 # assuming storage_options is to be interpreted as headers
    383 req_info = urllib.request.Request(filepath_or_buffer, headers=storage_options)
--> 384 with urlopen(req_info) as req:
    385     content_encoding = req.headers.get("Content-Encoding", None)
    386     if content_encoding == "gzip":
    387         # Override compression based on Content-Encoding header

File ~/miniforge3/envs/py312_likeness/lib/python3.12/site-packages/pandas/io/common.py:289, in urlopen(*args, **kwargs)
    283 """
    284 Lazy-import wrapper for stdlib urlopen, as that imports a big chunk of
    285 the stdlib.
    286 """
    287 import urllib.request
--> 289 return urllib.request.urlopen(*args, **kwargs)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/urllib/request.py:215, in urlopen(url, data, timeout, cafile, capath, cadefault, context)
    213 else:
    214     opener = _opener
--> 215 return opener.open(url, data, timeout)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/urllib/request.py:515, in OpenerDirector.open(self, fullurl, data, timeout)
    512     req = meth(req)
    514 sys.audit('urllib.Request', req.full_url, req.data, req.headers, req.get_method())
--> 515 response = self._open(req, data)
    517 # post-process response
    518 meth_name = protocol+"_response"

File ~/miniforge3/envs/py312_likeness/lib/python3.12/urllib/request.py:532, in OpenerDirector._open(self, req, data)
    529     return result
    531 protocol = req.type
--> 532 result = self._call_chain(self.handle_open, protocol, protocol +
    533                           '_open', req)
    534 if result:
    535     return result

File ~/miniforge3/envs/py312_likeness/lib/python3.12/urllib/request.py:492, in OpenerDirector._call_chain(self, chain, kind, meth_name, *args)
    490 for handler in handlers:
    491     func = getattr(handler, meth_name)
--> 492     result = func(*args)
    493     if result is not None:
    494         return result

File ~/miniforge3/envs/py312_likeness/lib/python3.12/urllib/request.py:1392, in HTTPSHandler.https_open(self, req)
   1391 def https_open(self, req):
-> 1392     return self.do_open(http.client.HTTPSConnection, req,
   1393                         context=self._context)

File ~/miniforge3/envs/py312_likeness/lib/python3.12/urllib/request.py:1347, in AbstractHTTPHandler.do_open(self, http_class, req, **http_conn_args)
   1344         h.request(req.get_method(), req.selector, req.data, headers,
   1345                   encode_chunked=req.has_header('Transfer-encoding'))
   1346     except OSError as err: # timeout error
-> 1347         raise URLError(err)
   1348     r = h.getresponse()
   1349 except:

URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)>

[jGaboardi]

See this thread in the US Census Bureau #bug-reports Slack channel