SSL：CERTIFICATE_VERIFY_FAILED 证书验证失败：自签名证书（_ssl.c：1129）

我正在尝试自动创建受信任的证书和非对称密钥，然后执行自动安装过程。目前，所有这些都是使用 OpenSSL 实用程序手动完成的。 我正在使用 Cryptography.io 库来实现此自动化，并尝试使用代码生成的证书连接到服务器。当我调用 Post On Session 时，出现错误：

httpx.ConnectError：[SSL：CERTIFICATE_VERIFY_FAILED]证书验证失败：自签名证书（_ssl.c：1129）

我为生成证书创建的代码：

import base64
import datetime
import json    
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.serialization import pkcs12
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography import x509
from cryptography.x509.oid import NameOID

    def create_certs(self):

    ca_key = ec.generate_private_key(curve=ec.SECP256R1, backend=default_backend())

    with open("/local/cert" + "/ca_key.pem", "wb") as f:
        f.write(ca_key.private_bytes(
            encoding=serialization.Encoding.PEM,
            format=serialization.PrivateFormat.TraditionalOpenSSL,
            encryption_algorithm=serialization.BestAvailableEncryption(b"passphrase")
        ))

    subject = issuer = x509.Name([
        x509.NameAttribute(NameOID.ORGANIZATIONAL_UNIT_NAME, u"Company"),
        x509.NameAttribute(NameOID.COMMON_NAME, u"interfaceCA")
    ])
    ca_cert = x509.CertificateBuilder().subject_name(
        subject
    ).issuer_name(
        issuer
    ).public_key(
        ca_key.public_key()
    ).serial_number(
        x509.random_serial_number()
    ).not_valid_before(
        datetime.datetime.utcnow()
    ).not_valid_after(
        datetime.datetime.utcnow() + datetime.timedelta(days=365)
    ).add_extension(
        x509.BasicConstraints(ca=True, path_length=None),
        critical=True
    ).add_extension(
        x509.SubjectKeyIdentifier.from_public_key(ca_key.public_key()),
        critical=False
    ).add_extension(
        x509.AuthorityKeyIdentifier.from_issuer_public_key(ca_key.public_key()),
        critical=False
    ).sign(
        ca_key, hashes.SHA256(), default_backend()
    )

    with open("/local/cert" + "/ca_crt.pem", "wb") as f:
        f.write(ca_cert.public_bytes(serialization.Encoding.PEM))       #used to install trusted certificate in server


    ################ Step 2 Assymetric key########################

    cert_key = ec.generate_private_key(curve=ec.SECP256R1,backend=default_backend())

    with open("/local/cert" + "/cert_key.pem", "wb") as f:
        f.write(cert_key.private_bytes(
            encoding=serialization.Encoding.PEM,
            format=serialization.PrivateFormat.TraditionalOpenSSL,
            encryption_algorithm=serialization.BestAvailableEncryption(b"passphrase")
        ))

    ### missing information how to convert openssl commands accurately to cryptography.io methods - 
    #   # openssl req -new -sha256 -key cert.key -out cert.csr -subj "/OU=Company/CN=<FQDN>"
    #   # openssl x509 -req -in cert.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out cert.crt -days 365 -sha256
        
    cert = x509.CertificateBuilder().subject_name(
        x509.Name([
        x509.NameAttribute(NameOID.ORGANIZATIONAL_UNIT_NAME, u"Company"),
        x509.NameAttribute(NameOID.COMMON_NAME, "https://fqdn.com:15623")])
    ).issuer_name(
        issuer
    ).serial_number(
        x509.random_serial_number()
    ).not_valid_before(
        datetime.datetime.utcnow()
    ).not_valid_after(
        datetime.datetime.utcnow() + datetime.timedelta(days=365)
    ).public_key(
        cert_key.public_key()
    ).sign(
        ca_key, hashes.SHA256(), default_backend()
    )

    with open("/local/cert" + "/cert_crt.pem", "wb") as f:
        f.write(cert.public_bytes(serialization.Encoding.PEM))

    bundle = pkcs12.serialize_key_and_certificates(
        name=b"container_p12",
        key=cert_key,
        cert=cert,
        encryption_algorithm=serialization.BestAvailableEncryption(b"pkcsPassword"),
        cas=None
    )

    with open("/local/cert" + "/container.p12", "wb") as f:
        f.write(bundle)

    bundle_base64_str = base64.b64encode(bundle)
    with open("/local/cert" + "/bundle-base64.p12", "wb") as f:   #used to install asymmetric key in server
        f.write(bundle_base64_str)

我可能缺少一些步骤来准确地自签名 asymkey 证书。而在 OpenSSL 手动过程中，CSR & CA & CA-key 用于为非对称密钥创建证书。

#   # openssl req -new -sha256 -key cert.key -out cert.csr -subj "/OU=Company/CN=<FQDN>"
#   # openssl x509 -req -in cert.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out cert.crt -days 365 -sha256

非常感谢对此的任何帮助。