diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index a5785d0..ea0e684 100644
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -855,6 +855,8 @@ class ContextTests(unittest.TestCase):
         with self.assertRaises(IOError) as cm:
             ctx.load_verify_locations(WRONGCERT)
         self.assertEqual(cm.exception.errno, errno.ENOENT)
+        with self.assertRaises(IOError):
+            ctx.load_verify_locations(u'')
         with self.assertRaisesRegexp(ssl.SSLError, "PEM lib"):
             ctx.load_verify_locations(BADCERT)
         ctx.load_verify_locations(CERTFILE, CAPATH)
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 5518032..11d34d6 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -2628,15 +2628,23 @@ load_verify_locations(PySSLContext *self, PyObject *args, PyObject *kwds)
     }
 
     if (cafile) {
-        cafile_bytes = PyString_AsEncodedObject(
-            cafile, Py_FileSystemDefaultEncoding, "strict");
+        PyObject *u = PyUnicode_FromObject(cafile);
+        if (!u)
+            goto error;
+        cafile_bytes = PyUnicode_AsEncodedString(
+            u, Py_FileSystemDefaultEncoding, NULL);
+        Py_DECREF(u);
         if (!cafile_bytes) {
             goto error;
         }
     }
     if (capath) {
-        capath_bytes = PyString_AsEncodedObject(
-            capath, Py_FileSystemDefaultEncoding, "strict");
+        PyObject *u = PyUnicode_FromObject(capath);
+        if (!u)
+            goto error;
+        capath_bytes = PyUnicode_AsEncodedString(
+            u, Py_FileSystemDefaultEncoding, NULL);
+        Py_DECREF(u);
         if (!capath_bytes) {
             goto error;
         }