Cloudflare's Chain Root CA removed from today's `certifi` update

Website, Application, Performance Security
1

What is the name of the domain?

edalo.net

What is the error message?

CERTIFICATE_VERIFY_FAILED

What is the issue you’re encountering

Today’s (2025-04-26) certifi update has removed the “AAA Certificate Services” Root CA that the Cloudflare certificate chain uses from the trust store (read more in 1957685 - Turn off Websites Trust Bit from CAs). As a result, Cloudflare is currently serving certificate chains that are not trusted, causing verification failures for newer Python clients.

What is the current SSL/TLS setting?

Flexible

What are the steps to reproduce the issue?

  1. Install Python’s certifi update of 2025.04.26

  2. Make a request to the server ( requests.get('https://edalo.net') )
    (The same exact command has worked for months until today, with the new certifi update)

  3. Get requests.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED]

2

This will become a much larger problem when the new version of Firefox Nightly releases soon, as it will use the new version of certifi.

3

firefox_138_139 (1)
firefox_138_139 (1)776×241 20.9 KB

Now on Firefox Nightly, too.

4

AAA

Not before: 01 Jan 2004
Not after: 31 Dec 2028

SSL.com TLS ECC CA R2

Not before: 21 Jun 2004
Not after: 31 Dec 2028

Cloudflare ECC CA 1

Not before: 31 Oct 2023
Not after: 28 Oct 2033

edalo.net

Not before: 17 Mar 2025
Not after: 15 Jun 2025

Might be you’ve got the “old one” cached while the new SSL certificate wasn’t re-issued? :thinking:

Are you running any Anti-virus/malware software which would scan the HTTP(S) requests as well?

5

Thank you for the response!

  1. Might be - is there a way to manually clear the cache through the dashboard?
  2. I do not
6

Seems to be the problem foreshadowed by @nick.gristle628

7

Did you find any solution to this ? I have the same issue…

9

No solution yet.

Currently the workaround is pinning certifi to version 2025.1.31.

According to this GitHub issue, the certifi developers are in talks with Cloudflare to resolve this.

10

Thanks for your answer and the link to github issue.

11

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.