How to fix SSL CERTIFICATE_VERIFY_FAILED when connecting the FastMCP/MCP Python Client to an HTTPS server with a self-signed certificate
When connecting the FastMCP Client (modelcontextprotocol/python-sdk) to an HTTPS MCP server that uses a self-signed or internal CA certificate, the client fails with 'ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] unable to get local issuer certificate'. The Client class has no verify parameter to disable verification or supply a custom certificate. What workarounds are available?
Originally asked on GitHub: https://github.com/modelcontextprotocol/python-sdk/issues/870
6 answers
The issue is closed as completed, but the thread does not name a released version that adds a verify option, so the solutions below are workarounds reported by users and commenters. The root cause, as explained in the thread, is that the MCP client creates an httpx client with default parameters, so httpx uses certifi's bundled CA store, and MCP exposes no option to change the verify setting.
Workarounds reported in the thread:
- Add 'import certifi_win32' at the very top of your script; one user reported the SSL error went away.
- Install pip-system-certs, the replacement for python-certifi-win32; one user said it worked for an on-prem deployed application.
- Temporary stopgap: append your internal CA certificate to certifi's cacert.pem in your virtual environment (for example venv/lib/python3.12/site-packages/certifi/cacert.pem). The thread notes this is only temporary, and that pinning certifi can keep an update from overwriting the change.
- Temporary code change: one user edited the local client library files to pass verify=False to the httpx client, and the connection then worked. The user called it a temporary solution.
Commenters also suggested building an SSL context with truststore and passing it to httpx.Client(verify=ssl_context) so the system CA store is used. The thread does not confirm that this works with the MCP client.
Security note: editing certifi's store or disabling verification affects all HTTPS connections made by that environment. Adding your internal CA to the system trust store keeps verification enabled.
Did this work for you?What @Akash321go tried on GitHub (Worked)
Added 'import certifi_win32' at the top of the script; the SSL error went away.
Did this work for you?What @aniketwattamwar tried on GitHub (Worked)
Installed pip-system-certs (the successor to python-certifi-win32); it worked for an on-prem deployed application.
Did this work for you?What @aniketwattamwar tried on GitHub (Worked)
Edited the local client library files to pass verify=False to the underlying httpx client; the connection then worked, and the user called it temporary.
Did this work for you?What @cabusar tried on GitHub (Outcome unclear)
Suggested building a truststore.SSLContext and passing it to httpx.Client(verify=ssl_context), and appending the internal CA to certifi's cacert.pem as a stopgap. The thread does not report that either approach was tried in this comment.
Did this work for you?What a GitHub user tried on GitHub (Didn't work)
Connected with Client(MCP_URL) to an HTTPS MCP server using a self-signed or internal certificate; the call failed with ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] unable to get local issuer certificate.
Source: https://github.com/modelcontextprotocol/python-sdk/issues/870 (opens external site)
Did this work for you?
Related questions
- MCP python-sdk simple-chatbot: 'Attempted to exit cancel scope in a different task than it was entered in'
- Why is my MCP resource template (greeting://{name}) not available in Claude Desktop?
- How to disable TLS certificate verification (verify=False) in MCP streamablehttp_client?
- anyio.ClosedResourceError in MCP StreamableHTTP message router on fast-failing requests?
- Python MCP SDK streamable HTTP: 'Error in message router' ClosedResourceError after 307 redirect