title: Why can't python SSL module verify graph.facebook.com certificate?
body: <p>By pointing my browser to <a href="https://graph.facebook.com/me" rel="nofollow">https://graph.facebook.com/me</a>, I get an encrypted HTTPS connection, which the certificate chain is:</p>
  
  <ul>
  <li>DigiCert High Assurance EV Root CA (root)</li>
  <li>DigiCert High Assurance CA-3</li>
  <li>*.facebook.com</li>
  </ul>
  
  <p>So I have downloaded the root certificate from <a href="https://www.digicert.com/digicert-root-certificates.htm" rel="nofollow">https://www.digicert.com/digicert-root-certificates.htm</a> (I have also exported it from my browser, diff shows they are the same thing), and tried to use Python built-in SSL module to verify the authenticity of the connection to graph.facebook.com.</p>
  
  <p>I have just executed the example <a href="http://docs.python.org/library/ssl.html#client-side-operation" rel="nofollow">http://docs.python.org/library/ssl.html#client-side-operation</a>, replacing the ca_cert with "DigiCertHighAssuranceEVRootCA.crt" and the address with graph.facebook.com. The connection attempt fails with the exception:</p>
  
  <pre><code>ssl.SSLError: [Errno 1] _ssl.c:499: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
  </code></pre>
  
  <p>If I try the same code and certificate against ev-root.digicert.com (which is the address provided by DigiCert for testing if the client can verify their certificate), everything works nicely. Via browser, I could verify that the chain used in this connection is:</p>
  
  <ul>
  <li>DigiCert High Assurance EV Root CA (root)</li>
  <li>DigiCert High Assurance EV CA-1</li>
  <li>ev-root.digicert.com</li>
  </ul>
  
  <p>By running
      ssl.get_server_certificate(('graph.facebook.com', 443))
  I get the same certificate identifyed as "*.facebook.com" by my browser, what means both Python code and my browser gets the same certificate to validate.</p>
  
  <p>Why Chrome can validate graph.facebook.com with the given root certficate, Python can validate another site with this same root certificate, but Python can not validate graph.facebook.com ?</p>