How to diagnose CERTIFICATE_VERIFY_FAILED on Windows for websites working in browsers?

[Chi Hsuan Yen]

Hi Python enthusiasts,

I'm working on youtube-dl, a handy tool for downloading videos from various
websites. There are occasional bug reports with SSL error
CERTIFICATE_VERIFY_FAILED when people are trying to download videos from
youtube.com [1] or dailymotion.com [2]. The issue about youtube.com turned
out to be expired intermediate CA certificates. Some users report that
there's one or more expired "Google Internet Authority G2" certificate on
their machines. Apparently OpenSSL verifies the whole certificate chain and
report an error as soon as it finds an invalid certificate in the chain. My
questions is: how to tell from several possible causes to
CERTIFICATE_VERIFY_FAILED? Currently both expired self signed certificate
leads to CERTIFICATE_VERIFY_FAILED. Thanks for any help or advice.

Best,

Yen Chi Hsuan

[1] https://github.com/rg3/youtube-dl/issues/7309
[2] https://github.com/rg3/youtube-dl/issues/10574