pip: SSL: CERTIFICATE_VERIFY_FAILED with Python 3.6.0

  • Pip version: 9.0.1
  • Python version: 3.6.0
  • Operating System: macOS Sierra

Description:

I am getting a certificate error for pypi.python.org when I run pip install -U channels. I don’t know if issue is related to pip or Python 3.6.0 or something else. I have tried the following suggestions but none of them worked.

pip --trusted-host pypi.python.org install -U channels

export PIP_CERT=/Users/user/Desktop/certificate_which_i_obtained_from_pypi_dot_python_dot_org.crt
pip install -U channels

The following cacert.pem is curl’s certificate. pip --cert /Users/user/cacert.pem install -U channels

I also suspect that the issue might have something to do with Python 3.6.0. Because consider the following output:

user@host:~$ python
Python 3.6.0 (v3.6.0:41df79263a11, Dec 22 2016, 17:23:13) 
[GCC 4.2.1 (Apple Inc. build 5666) (dot 3)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import ssl
>>> context = ssl.create_default_context()
>>> context.cert_store_stats()
{'x509': 0, 'crl': 0, 'x509_ca': 0}
>>> context.get_ca_certs()
[]
>>> 

What I’ve run:

(virtualenv) user@host:~/Documents/virtualenv$ pip install -U channels
Collecting channels
  Using cached channels-0.17.3-py2.py3-none-any.whl
Collecting asgiref>=0.13 (from channels)
  Using cached asgiref-1.0.0-py2.py3-none-any.whl
Collecting daphne>=0.14.1 (from channels)
  Using cached daphne-0.15.0-py2.py3-none-any.whl
Requirement already up-to-date: Django>=1.8 in ./lib/python3.6/site-packages (from channels)
Collecting six (from asgiref>=0.13->channels)
  Using cached six-1.10.0-py2.py3-none-any.whl
Collecting twisted>=16.0 (from daphne>=0.14.1->channels)
  Using cached Twisted-16.6.0.tar.bz2
    Complete output from command python setup.py egg_info:
    Download error on https://pypi.python.org/simple/incremental/: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:749) -- Some packages may not be found!
    Couldn't find index page for 'incremental' (maybe misspelled?)
    Download error on https://pypi.python.org/simple/: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:749) -- Some packages may not be found!
    No local packages or working download links found for incremental>=16.10.1
    Traceback (most recent call last):
      File "<string>", line 1, in <module>
      File "/private/var/folders/45/r4yr9bbj29dfbtxqv75_785m0000gn/T/pip-build-02d49zb3/twisted/setup.py", line 21, in <module>
        setuptools.setup(**_setup["getSetupArgs"]())
      File "/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/distutils/core.py", line 108, in setup
        _setup_distribution = dist = klass(attrs)
      File "/Users/user/Documents/virtualenv/lib/python3.6/site-packages/setuptools/dist.py", line 316, in __init__
        self.fetch_build_eggs(attrs['setup_requires'])
      File "/Users/user/Documents/virtualenv/lib/python3.6/site-packages/setuptools/dist.py", line 371, in fetch_build_eggs
        replace_conflicting=True,
      File "/Users/user/Documents/virtualenv/lib/python3.6/site-packages/pkg_resources/__init__.py", line 846, in resolve
        dist = best[req.key] = env.best_match(req, ws, installer)
      File "/Users/user/Documents/virtualenv/lib/python3.6/site-packages/pkg_resources/__init__.py", line 1118, in best_match
        return self.obtain(req, installer)
      File "/Users/user/Documents/virtualenv/lib/python3.6/site-packages/pkg_resources/__init__.py", line 1130, in obtain
        return installer(requirement)
      File "/Users/user/Documents/virtualenv/lib/python3.6/site-packages/setuptools/dist.py", line 439, in fetch_build_egg
        return cmd.easy_install(req)
      File "/Users/user/Documents/virtualenv/lib/python3.6/site-packages/setuptools/command/easy_install.py", line 668, in easy_install
        raise DistutilsError(msg)
    distutils.errors.DistutilsError: Could not find suitable distribution for Requirement.parse('incremental>=16.10.1')
    
    ----------------------------------------
Command "python setup.py egg_info" failed with error code 1 in /private/var/folders/45/r4yr9bbj29dfbtxqv75_785m0000gn/T/pip-build-02d49zb3/twisted/
(virtualenv) user@host:~/Documents/virtualenv$ 

About this issue

  • Original URL
  • State: closed
  • Created 8 years ago
  • Reactions: 4
  • Comments: 23 (2 by maintainers)

Most upvoted comments

Try installing new version of pip directly using get-pip.py (see https://pip.pypa.io/en/stable/installing/)

$ curl 'https://bootstrap.pypa.io/get-pip.py' > get-pip.py
$ sudo python get-pip.py

(formatted by @pradyunsg)

pip install incremental

I had this issue as well.

The problem seems to stem from the ssl module not being enabled when building Python 3.6.0.

I got around this by uncommenting lines 209-212 in Python-3.6.0/Modules/Setup

SSL=/usr/local/ssl
_ssl _ssl.c \
        -DUSE_SSL -I$(SSL)/include -I$(SSL)/include/openssl \
        -L$(SSL)/lib -lssl -lcrypto

and make sure libssl-dev is installed (this is the package for debian, anyway).

Once that’s done, do ./configure, make, and make install again and it should work.

Still doesn’t work, please help…

C:\Windows\system32>pip install incremental Collecting incremental Could not fetch URL https://pypi.python.org/simple/incremental/: There was a problem confirming the ssl certificate: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:748) - skipping Could not find a version that satisfies the requirement incremental (from versions: ) No matching distribution found for incremental

Not sure why, perhaps because of Pypi no longer accepting http connections… But changing the mirror works for me:

$ cat ~/.config/pip/pip.conf
[global]
proxy = http://my-proxy:8080
index-url = http://mirrors.aliyun.com/pypi/simple/
trusted-host = mirrors.aliyun.com

brew update brew uninstall openssl brew install openssl echo ‘export PATH=“/usr/local/opt/openssl/bin:$PATH”’ >> ~/.bash_profile

on OSX, using macport, installing curl-ca-bundle solves it:

sudo port install curl-ca-bundle

I would not call --trusted-host a fix. At best it is a dangerous workaround. You are disabling TLS verification and open up your computer to man-in-the-middle attacks. The option should have been called --bypass-insecure-host or similar.

I have the exact same issue on Python 3.5, latest OSX:

$ pip install pip --upgrade
Could not fetch URL https://pypi.python.org/simple/pip/: There was a problem confirming the ssl certificate: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:720) - skipping

I fixed it by using the trusted host parameter:

$ pip install --trusted-host pypi.python.org pip --upgrade
Requirement already up-to-date: pip in ./venv/lib/python3.5/site-packages

how about just installing certifi as mentioned here (this link appears soon after one installs Python 3.6)?

pip install certifi

none of the solutions worked for me. I’m on OSX