There was a problem confirming the ssl certificate: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed

pip prints it as "Could not fetch URL <url>: There was a problem confirming the ssl certificate: … - skipping", after several "WARNING: Retrying (Retry(total=…)) after connection broken by 'SSLError(…)'" lines. The URL and the final reason vary.

pip — index or find-links URL over HTTPS (pip 24.2+ verifies with truststore by default)

What it means

pip could not verify the TLS certificate of the package index (or a find-links URL), so it skipped that page and usually ends with "Could not find a version that satisfies the requirement". The reason after the colon is the OpenSSL verification result. Since pip 24.2, pip verifies with the operating system's trust store through truststore, so the CA is missing from the OS store, or pip is told to use another bundle.

Why it happens

• A private index (Artifactory, Nexus, devpi) with a company certificate

  common

  Internal package mirrors use certificates from a company CA that is present on managed laptops but not in CI images, containers or fresh virtual machines.

• A TLS-inspecting proxy in front of pypi.org

  common

  On company networks, pypi.org and files.pythonhosted.org are re-signed by the proxy. Without its root in the trust store pip uses, every install fails.

• pip is configured to use certifi instead of the OS store

  occasional

  --use-deprecated=legacy-certs, an explicit cert setting pointing at certifi, or pip running on Python 3.9 or older (where truststore is not available) means roots added to the OS store are not used.

• An old pip bundled with the Python installation

  occasional

  pip before 24.2 always used its vendored certifi bundle. Many base images and virtual environments still ship such versions.

How to fix it

1. 1.

   Install the CA into the OS trust store

   With pip 24.2+ on Python 3.10+, roots in the system store (or Keychain / Windows store) are trusted automatically. Upgrade pip if it is older.

   # pip >= 24.2 uses the OS trust store (truststore): add the CA there
   sudo cp corp-root-ca.pem /usr/local/share/ca-certificates/corp-root-ca.crt
   sudo update-ca-certificates
   python3 -m pip --version     # upgrade pip itself if it is older than 24.2

2. 2.

   Give pip a CA bundle explicitly

   global.cert in pip's configuration, PIP_CERT or --cert make pip verify with that file. Include public roots too if pip also talks to pypi.org.

   # A CA bundle for pip only (one of these):
   python3 -m pip config set global.cert /etc/ssl/private-ca/corp-ca-bundle.pem
   export PIP_CERT=/etc/ssl/private-ca/corp-ca-bundle.pem
   python3 -m pip install --cert /etc/ssl/private-ca/corp-ca-bundle.pem requests

3. 3.

   Configure the private index once

   Put index-url and cert into pip.conf (or pip.ini) so every pip invocation, including those inside build tools, uses them.

   # pip.conf (Linux: ~/.config/pip/pip.conf, Windows: %APPDATA%\pip\pip.ini)
   [global]
   index-url = https://pypi.example.com/simple/
   cert = /etc/ssl/private-ca/corp-ca-bundle.pem

4. 4.

   Temporary diagnostic: --trusted-host

   --trusted-host turns off certificate verification for that host and lets pip use plain HTTP there. It confirms the diagnosis, but anything downloaded this way could have been replaced in transit; do not keep it in configuration.

   # Temporary diagnostic only: --trusted-host disables certificate checks for that host
   python3 -m pip download --no-deps -d /tmp/dl --index-url https://pypi.example.com/simple/ \
     --trusted-host pypi.example.com requests

← Browse the full signature error database