Pip install ssl error

asked Sep 22, 2014 at 19:25

pip install gensim config --global http.sslVerify false

Just install any package with the «config —global http.sslVerify false» statement

You can ignore SSL errors by setting pypi.org and files.pythonhosted.org as well as the older pypi.python.org as trusted hosts.

$ pip install --trusted-host pypi.org --trusted-host pypi.python.org --trusted-host files.pythonhosted.org <package_name>

Note: Sometime during April 2018, the Python Package Index was migrated from pypi.python.org to pypi.org. This means «trusted-host» commands using the old domain no longer work, but you can add both.

Permanent Fix

Since the release of pip 10.0, you should be able to fix this permanently just by upgrading pip itself:

$ pip install --trusted-host pypi.org --trusted-host pypi.python.org --trusted-host files.pythonhosted.org pip setuptools

Or by just reinstalling it to get the latest version:

$ curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py

(… and then running get-pip.py with the relevant Python interpreter).

pip install <otherpackage> should just work after this. If not, then you will need to do more, as explained below.

You may want to add the trusted hosts and proxy to your config file.

pip.ini (Windows) or pip.conf (unix)

[global]
trusted-host = pypi.python.org
               pypi.org
               files.pythonhosted.org

Alternate Solutions (Less secure)

Most of the answers could pose a security issue.

Two of the workarounds that help in installing most of the python packages with ease would be:

• Using easy_install: if you are really lazy and don’t want to waste much time, use easy_install <package_name>. Note that some packages won’t be found or will give small errors.
• Using Wheel: download the Wheel of the python package and use the pip command pip install wheel_package_name.whl to install the package.

Use the --cert argument:

You can specify a certificate with:

pip --cert <path/to/cert>.pem install <package list>

e.g.:

pip --cert /etc/ssl/certs/FOO_Root_CA.pem install linkchecker

See: Docs » Reference Guide » pip

If specifying your company’s root cert doesn’t work maybe the cURL one will work: http://curl.haxx.se/ca/cacert.pem

You must use a PEM file and not a CRT file. If you have a CRT file you will need to convert the file to PEM There are reports in the comments that this now works with a CRT file but I have not verified.

Also check: SSL Cert Verification.

For me the problem was fixed by creating a folder
pip, with a file: pip.ini
in
C:Users<username>AppDataRoaming
e.g:

C:Users<username>AppDataRoamingpippip.ini

Inside it I wrote:

[global]
trusted-host = pypi.python.org
               pypi.org
               files.pythonhosted.org

I restarted python, and then pip permanently trusted these sites, and used them to download packages from.

If you can’t find the AppData Folder on windows, write %appdata% in file explorer and it should appear.

answered Aug 24, 2018 at 14:24

Permanent fix — pip config

I had ssl issues due to company network security related to netscope. My machine is windows 10 with python 3.9 and the following command worked for me.

pip config set global.trusted-host 
    "pypi.org files.pythonhosted.org pypi.python.org" 
    --trusted-host=pypi.python.org 
    --trusted-host=pypi.org 
    --trusted-host=files.pythonhosted.org

Here, pip permanently trusted these sites, and now we can use them to download any packages.

kenorb’s answer is very useful (and great!).

Among his solutions, maybe this is the most simple one:
--trusted-host

For example, in this case you can do

pip install --trusted-host pypi.python.org linkchecker

The pem file(or anything else) is unnecessary.

The answers are quite similar and a bit confusing. In my case, the certificates in my company’s network was the issue. I was able to work around the problem using:

pip install --trusted-host files.pythonhosted.org --trusted-host pypi.org --trusted-host pypi.python.org oauthlib -vvv

As seen here. The -vvv argument can be omited if verbose output is not required

answered May 7, 2018 at 21:39

Permanent Fix

pip install --upgrade pip --trusted-host pypi.org --trusted-host files.pythonhosted.org

For eg:

pip install <package name> --trusted-host pypi.org --trusted-host files.pythonhosted.org

answered May 6, 2019 at 17:17

I tried majority of the solutions provided in this answer blog, however none of them worked, I had this ssl certificant error as I try to install python packages.

I succeed by following command:

python -m pip install PACKAGENAME --trusted-host=pypi.python.org --trusted-host=pypi.org --trusted-host=files.pythonhosted.org 

answered Oct 18, 2020 at 23:16

The most straightforward way I’ve found, is to download and use the «DigiCert High Assurance EV Root CA» from DigiCert at https://www.digicert.com/digicert-root-certificates.htm#roots

You can visit https://pypi.python.org/ to verify the cert issuer by clicking on the lock icon in the address bar, or increase your geek cred by using openssl:

$ openssl s_client -connect pypi.python.org:443
CONNECTED(00000003)
depth=1 /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/businessCategory=Private Organization/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=Delaware/serialNumber=3359300/street=16 Allen Rd/postalCode=03894-4801/C=US/ST=NH/L=Wolfeboro,/O=Python Software Foundation/CN=www.python.org
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA

The last CN value in the certificate chain is the name of the CA that you need to download.

For a one-off effort, do the following:

1. Download the CRT from DigiCert
2. Convert the CRT to PEM format
3. Export the PIP_CERT environment variable to the path of the PEM file

(the last line assumes you are using the bash shell) before running pip.

curl -sO http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt 
openssl x509 -inform DES -in DigiCertHighAssuranceEVRootCA.crt -out DigiCertHighAssuranceEVRootCA.pem -text
export PIP_CERT=`pwd`/DigiCertHighAssuranceEVRootCA.pem

To make this re-usable, put DigiCertHighAssuranceEVRootCA.crt somewhere common and export PIP_CERT accordingly in your ~/.bashrc.

answered Feb 25, 2015 at 16:53

To solve this problem once and for all, you can verify that you have a pip.conf file.

This is where your pip.conf should be, according to the documentation:

On Unix the default configuration file is: $HOME/.config/pip/pip.conf which respects the XDG_CONFIG_HOME environment variable.

On macOS the configuration file is $HOME/Library/Application Support/pip/pip.conf if directory $HOME/Library/Application Support/pip exists else $HOME/.config/pip/pip.conf

On Windows the configuration file is %APPDATA%pippip.ini.

Inside a virtualenv:

On Unix and macOS the file is $VIRTUAL_ENV/pip.conf

On Windows the file is: %VIRTUAL_ENV%pip.ini

Your pip.conf should look like:

[global]
trusted-host = pypi.python.org

pip install linkchecker installed linkchecker without complains after I created the pip.conf file.

You’ve the following possibilities to solve issue with CERTIFICATE_VERIFY_FAILED:

• Use HTTP instead of HTTPS (e.g. --index-url=http://pypi.python.org/simple/).

• Use --cert <trusted.pem> or CA_BUNDLE variable to specify alternative CA bundle.

  E.g. you can go to failing URL from web-browser and import root certificate into your system.

• Run python -c "import ssl; print(ssl.get_default_verify_paths())" to check the current one (validate if exists).

• OpenSSL has a pair of environments (SSL_CERT_DIR, SSL_CERT_FILE) which can be used to specify different certificate database^PEP-476.
• Use --trusted-host <hostname> to mark the host as trusted.
• In Python use verify=False for requests.get (see: SSL Cert Verification).
• Use --proxy <proxy> to avoid certificate checks.

Read more at: TLS/SSL wrapper for socket objects — Verifying certificates.

answered Aug 24, 2016 at 13:30

Set Time and Date correct!

For me, it came out that my date and time was misconfigured on Raspberry Pi. The result was that all SSL and HTTPS connections failed, using the https://files.pythonhosted.org/ server.

Update it like this:

sudo date -s "Wed Thu  23 11:12:00 GMT+1 2018"
sudo dpkg-reconfigure tzdata

Or directly with e.g. Google’s time:

Ref.: https://superuser.com/a/635024/935136

sudo date -s "$(curl -s --head http://google.com | grep ^Date: | sed 's/Date: //g')"
sudo dpkg-reconfigure tzdata

answered Aug 23, 2018 at 9:30

I recently ran into this problem because of my company’s web content filter that uses its own Certificate Authority so that it can filter SSL traffic. PIP doesn’t seem to be using the system’s CA certificates in my case, producing the error you mention. Downgrading PIP to version 1.2.1 presented its own set of problems later on, so I went back to the original version that came with Python 3.4.

My workaround is quite simple: use easy_install. Either it doesn’t check the certs (like the old PIP version), or it knows to use the system certs because it works every time for me and I can still use PIP to uninstall packages installed with easy_install.

If that doesn’t work and you can get access to a network or computer that doesn’t have the issue, you could always setup your own personal PyPI server: how to create local own pypi repository index without mirror?

I almost did that until I tried using easy_install as a last ditch effort.

You can try to bypass the SSL error by using http instead of https. Of course this is not optimal in terms of security, but if you are in a hurry it should do the trick:

pip install --index-url=http://pypi.python.org/simple/ linkchecker

answered Oct 3, 2014 at 13:01

You have 4 options:

Using a certificate as parameter

$ pip install --cert /path/to/mycertificate.crt linkchecker

Using a certificate in a pip.conf

Create this file:

$HOME/.pip/pip.conf (Linux)

%HOME%pippip.ini (Windows)

and add these lines:

[global]
cert = /path/to/mycertificate.crt

Ignoring certificate and using HTTP

$ pip install --trusted-host pypi.python.org linkchecker

Ignoring certificate and using HTTP in a pip.conf

Create this file:

$HOME/.pip/pip.conf (Linux)

%HOME%pippip.ini (Windows)

and add these lines:

[global]
trusted-host = pypi.python.org

Source

• https://pip.pypa.io/en/latest/user_guide/#configuration

I installed pip 1.2.1 with easy_install and upgraded to latest version of pip (6.0.7 at the time) which is able to install packages in my case.

easy_install pip==1.2.1
pip install --upgrade pip

answered Feb 4, 2015 at 14:20

pmbotterpmbotter

4631 gold badge6 silver badges7 bronze badges

First of all,

    pip install --trusted-host pypi.python.org <package name>

did not work for me. I kept getting the CERTIFICATE_VERIFY_FAILED error. However, I noticed in the error messages that they referenced the ‘pypi.org’ site. So, I used this as the trusted host name instead of pypi.python.org. That almost got me there; the load was still failing with CERTIFICATE_VERIFY_FAILED, but at a later point. Finding the reference to the website that was failing, I included it as a trusted host. What eventually worked for me was:

    pip install --trusted-host pypi.org --trusted-host files.pythonhosted.org <package name>

answered Apr 23, 2018 at 16:50

Don’t Skip! Found Safe Solution for Linux

All the solutions of adding pypi.org to trusted sites with --trusted-host is not safe, basically skipping https, not really fixing the problem.
Everyone which uses this approach, please try to update your cert this way and remove --trusted-host flag:

sudo yum -y update ca-certificates
export PIP_CERT=/etc/ssl/certs/ca-bundle.crt 

Safety Matters!

answered Oct 15, 2020 at 8:51

Had the same problem trying pip install ftputil with ActivePython 2.7.8, ActivePython 3.4.1, and «stock» Python 3.4.2 on 64-bit Windows 7 Enterprise. All attempts failed with the same errors as OP.

Worked around the problem for Python 3.4.2 by downgrading to pip 1.2.1: easy_install pip==1.2.1 (see https://stackoverflow.com/a/16370731/234235). Same fix also worked for ActivePython 2.7.8.

The bug, reported in March 2013, is still open: https://github.com/pypa/pip/issues/829.

I’m not sure if this is related, but I had a similar problem which was fixed by copying these files from Anaconda3/Library/bin to Anaconda3/DLLs :

libcrypto-1_1-x64.dll

libssl-1_1-x64.dll

answered May 12, 2019 at 20:25

I attempted with using the corporate proxy but it failed.

I’m using Python 3.6.

pip.conf file was missing.

Here are the steps to solve the issue:

1. Install certificate package: -pip --trusted-host pypi.python.org --trusted-host files.pythonhosted.org --trusted-host pypi.org install certifi

2. Create a pip.conf file, as so:

     $ cd ~/.config 
     $ mkdir pip
     $ cd pip
     $ nano pip.conf

Add the following to the newly created .conf file, and save it.

[global]
trusted-host = pypi.python.org files.pythonhosted.org pypi.org pypi.io

All done and it started working.

Dan AustinDan Austin

791 silver badge4 bronze badges

Gil BaggioGil Baggio

12.3k3 gold badges47 silver badges34 bronze badges

Aniket SinghAniket Singh

2,3241 gold badge20 silver badges31 bronze badges

One solution (for Windows) is to create a file called pip.ini on the %AppData%pip folder (create the folder if it doesn’t exist) and insert the following details:

[global]
cert = C:/certs/python_root.pem
proxy = http://my_user@my_company.com:my_password@proxy_ip:proxy_port

…and then we can execute the install instruction:

pip3 install PyQt5

Another option is to install the package using arguments for the proxy and certificate…

$ pip3 install --proxy http://my_user@my_company.com:my_password@proxy_ip:proxy_port 
   --cert C:/certs/python_root.pem PyQt5

To convert the certificate *.cer files to the required *.pem format execute the following instruction:

$ openssl x509 -inform der -in python_root.cer -out python_root.pem

Hope this helps someone!

In my case it was due to SSL certificate being signed by internal CA of my company. Using workarounds like pip --cert did not help, but the following package did:

pip install pip_system_certs

See: https://pypi.org/project/pip-system-certs/

This package patches pip and requests at runtime to use certificates from the default system store (rather than the bundled certs ca).

This will allow pip to verify tls/ssl connections to servers who’s cert is trusted by your system install.

LionHLionH

1646 bronze badges

answered Apr 28, 2014 at 14:32

answered Jul 17, 2020 at 15:17