SSL_CERTIFICATE_VERIFY_FAILED in VS Code Python Debugger on macOS, Terminal and PyCharm Work Fine

[adamwagman-customerinsightscdp]

Bug Description

When running Python unit tests that connect to AWS services inside the VS Code Python debugger, I consistently get:

yaml
CopyEdit
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate

• This error occurs only inside the VS Code debugger

• The same code works correctly:

  • In PyCharm's debugger

  • From the terminal using pytest

  • From VS Code's integrated terminal

• Environment variables such as SSL_CERT_FILE are set properly and visible inside the test

• ssl.get_default_verify_paths() reflects the correct certificate bundle

• The problem persists across Python 3.12 and 3.13

• Downgrading the VS Code Python extension from 2025.8.0 to 2025.6.1 does not resolve the issue

---

Reproduction Steps

1. On macOS 15.5 with Homebrew OpenSSL 3.5.0 installed

2. Create a Python virtual environment using python.org Python 3.12 or 3.13

3. Install boto3, certifi, and pytest

4. Set SSL_CERT_FILE to point to certifi's cacert.pem bundle

5. Run pytest from terminal — works as expected

6. Run debugger in VS Code (using the Python extension) — SSL error occurs

---

Environment Details

Component | Version -- | -- macOS | 15.5 (M4 MacBook Air) Python | 3.12 and 3.13 (installed from python.org) VS Code | [Insert your VS Code version, from About menu] VS Code Python Extension | Tested with 2025.8.0 and 2025.6.1 debugpy | VS Code bundled version (exact version unknown) Homebrew OpenSSL | 3.5.0

---

What Works

✔ PyCharm debugger runs tests without SSL issues
✔ Running tests from terminal (pytest) works
✔ VS Code integrated terminal runs tests without issues

---

What Fails

❌ Running the same tests inside the VS Code Python debugger produces SSL_CERTIFICATE_VERIFY_FAILED

---

Additional Notes

• This appears to be related to environment propagation or timing during debugger launch

• The debugpy debugger likely initializes Python's ssl context before the SSL_CERT_FILE environment variable is fully applied

• Recent updates to Homebrew OpenSSL 3.5.0 and/or macOS 15.5 may have exposed this behavior

• Other developers using a similar setup may face this issue without realizing the debugger is the source

---

Request

Please investigate whether debugpy or the VS Code Python extension mishandles environment propagation during debugger launch, especially in relation to SSL_CERT_FILE and Python's ssl initialization.

---

✅ Thank you for your time and assistance.

[eleanorjboyd]

Hello! Thank you for your detailed report, this is extremely helpful! A few questions, this problem doesn't occur when you run normally right? Like without the debugger? Also are you running the tests via the testing panel or do you have a launch.json set up and you run them through the run and debug panel? Finally can you try running this same setup using no-config debugging? This is another method we have of starting the debug process and I am curious if it has any impact (especially given it might be a race condition issue like you discussed) here are docs on how to do it

[adamwagman-customerinsightscdp]

Correct; I can run "pytest testname.py" successfully in a VS Code terminal.
I think the problem may not be "using the debugger" but rather "running the test any way other than the command line." I just saw that if I start from the VS Code side menu "Testing" item, go to the relevant test, and click "Run Test", I also get the exception (and also using "Debug test").

BTW, my analysis of this issue was done using ChatGPT to guide me through various experiments (like Homebrew Python vs python.org python, configuring SSL certificates, etc.), and it wrote up the bug report, so its description has some of its speculations like a race condition.

What is "no-config debugging"?

[eleanorjboyd]

Gotcha ya that makes sense- and good to know it doesn't work for any of those entry points. No config debug is just a way to start a debugging process directly from the command line, this should explain the steps and everything: https://github.com/microsoft/vscode-python-debugger/wiki/No%E2%80%90Config-Debugging

Not sure if that helps, but I noticed weird behavior when I had REQUESTS_CA_BUNDLE variable set in my windows user variables. When I remove it and ensure that it is not accessible within new terminal sessions I experience consistent behavior.
Moreover, it also helps if I just run os.environ['REQUESTS_CA_BUNDLE'] = certifi.where() prior to my code execution.
Note however, and I am not sure if that is a good practice, that I had to add root certificate from my custom bundle to the certifi cacert.pem file...

[eleanorjboyd]

@rchiodo any ideas here?

[rchiodo]

I think you already diagnosed the issue. It sounds like an environment variable problem. It may work if you start VS code from the terminal where the pytest works. VS code should pick up the environment in that case. Alternatively you can specify environment variables in your launch.json.