Trusting Russian Ministry CA Only for One Python Client: Handling CERTIFICATE_VERIFY_FAILED with aiohttp and httpx
A developer connecting a Python bot to the MAX messenger API encountered ClientConnectorCertificateError due to an SSL certificate chain signed by the Russian Ministry of Digital Development. The server presents a leaf certificate for *.max.ru and the intermediate Russian Trusted Sub CA, but the root Russian Trusted Root CA is absent from Debian, certifi, and Windows stores. Adding the intermediate to system stores or certifi would expose all clients in the process, including those talking to Telegram and Anthropic, to broad trust in the government CA. The solution creates a dedicated SSLContext using create_default_context, loads only the Sub CA via load_verify_locations, and enables VERIFY_X509_PARTIAL_CHAIN so the context stops at the intermediate without requiring the root. This context is passed exclusively to the aiohttp TCPConnector for the MAX session, leaving global ssl state, certifi, and other connections untouched. Equivalent patterns are shown for httpx.Client, urllib.request, and requests via a custom HTTPAdapter that injects the context only for the target host.
HabrOct 31, 2026Translated from Russian