diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 5e68596..8dad013 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -29,6 +29,7 @@ jobs:
         run: |
           python -m pip install -U pip
           python -m pip install -U setuptools twine wheel
+          python -m pip install -r requirements.txt
 
       - name: Build package
         run: |
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index a9985cf..e58f310 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -38,6 +38,7 @@ jobs:
         run: |
           python -m pip install -U pip
           python -m pip install -U pytest pytest-cov mock
+          python -m pip install -r requirements.txt
 
       - name: Tests
         shell: bash
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 0000000..963eac5
--- /dev/null
+++ b/requirements.txt
@@ -0,0 +1 @@
+certifi
diff --git a/setup.py b/setup.py
index 474ebe8..930ffe4 100644
--- a/setup.py
+++ b/setup.py
@@ -47,6 +47,7 @@ def local_scheme(version):
       zip_safe=True,
       use_scm_version={"local_scheme": local_scheme},
       setup_requires=["setuptools_scm"],
+      install_requires=["certifi"],
       entry_points="""
       # -*- Entry points: -*-
       [console_scripts]
diff --git a/twitter/api.py b/twitter/api.py
index 0493ada..6d8300e 100644
--- a/twitter/api.py
+++ b/twitter/api.py
@@ -17,6 +17,8 @@
     import urllib2 as urllib_request
     import urllib2 as urllib_error
 
+import certifi
+
 try:
     from cStringIO import StringIO
 except ImportError:
@@ -375,7 +377,7 @@ def __call__(self, params={}, **kwargs):
             return self._handle_response(req, uri, arg_data, _timeout)
 
     def _handle_response(self, req, uri, arg_data, _timeout=None):
-        kwargs = {}
+        kwargs = {'cafile': certifi.where()}
         if _timeout:
             kwargs['timeout'] = _timeout
         try:
diff --git a/twitter/stream.py b/twitter/stream.py
index 793049a..b3d97a9 100644
--- a/twitter/stream.py
+++ b/twitter/stream.py
@@ -16,11 +16,14 @@
 else:
     import urllib2 as urllib_request
     import urllib2 as urllib_error
+
+import certifi
+
 import json
 from ssl import SSLError
 import socket
 import codecs
-import sys, select, time
+import select, time
 
 from .api import TwitterCall, wrap_response, TwitterHTTPError
 
@@ -218,7 +221,7 @@ def handle_stream_response(req, uri, arg_data, block, timeout, heartbeat_timeout
         context = None
         if not verify_context and _HAVE_SSL:
             context = ssl._create_unverified_context()
-        handle = urllib_request.urlopen(req, context=context)
+        handle = urllib_request.urlopen(req, context=context, cafile=certifi.where())
     except urllib_error.HTTPError as e:
         raise TwitterHTTPError(e, uri, 'json', arg_data)
     return iter(TwitterJSONIter(handle, uri, arg_data, block, timeout, heartbeat_timeout))