Pip: SSL: CERTIFICATE_VERIFY_FAILED with Python 3.6.0

[ugultopu]

• Pip version: 9.0.1
• Python version: 3.6.0
• Operating System: macOS Sierra

Description:

I am getting a certificate error for pypi.python.org when I run pip install -U channels. I don't know if issue is related to pip or Python 3.6.0 or something else. I have tried the following suggestions but none of them worked.

pip --trusted-host pypi.python.org install -U channels

export PIP_CERT=/Users/user/Desktop/certificate_which_i_obtained_from_pypi_dot_python_dot_org.crt
pip install -U channels

The following cacert.pem is curl's certificate.
pip --cert /Users/user/cacert.pem install -U channels

I also suspect that the issue might have something to do with Python 3.6.0. Because consider the following output:

user@host:~$ python
Python 3.6.0 (v3.6.0:41df79263a11, Dec 22 2016, 17:23:13) 
[GCC 4.2.1 (Apple Inc. build 5666) (dot 3)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import ssl
>>> context = ssl.create_default_context()
>>> context.cert_store_stats()
{'x509': 0, 'crl': 0, 'x509_ca': 0}
>>> context.get_ca_certs()
[]
>>> 

What I've run:

(virtualenv) user@host:~/Documents/virtualenv$ pip install -U channels
Collecting channels
  Using cached channels-0.17.3-py2.py3-none-any.whl
Collecting asgiref>=0.13 (from channels)
  Using cached asgiref-1.0.0-py2.py3-none-any.whl
Collecting daphne>=0.14.1 (from channels)
  Using cached daphne-0.15.0-py2.py3-none-any.whl
Requirement already up-to-date: Django>=1.8 in ./lib/python3.6/site-packages (from channels)
Collecting six (from asgiref>=0.13->channels)
  Using cached six-1.10.0-py2.py3-none-any.whl
Collecting twisted>=16.0 (from daphne>=0.14.1->channels)
  Using cached Twisted-16.6.0.tar.bz2
    Complete output from command python setup.py egg_info:
    Download error on https://pypi.python.org/simple/incremental/: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:749) -- Some packages may not be found!
    Couldn't find index page for 'incremental' (maybe misspelled?)
    Download error on https://pypi.python.org/simple/: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:749) -- Some packages may not be found!
    No local packages or working download links found for incremental>=16.10.1
    Traceback (most recent call last):
      File "<string>", line 1, in <module>
      File "/private/var/folders/45/r4yr9bbj29dfbtxqv75_785m0000gn/T/pip-build-02d49zb3/twisted/setup.py", line 21, in <module>
        setuptools.setup(**_setup["getSetupArgs"]())
      File "/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/distutils/core.py", line 108, in setup
        _setup_distribution = dist = klass(attrs)
      File "/Users/user/Documents/virtualenv/lib/python3.6/site-packages/setuptools/dist.py", line 316, in __init__
        self.fetch_build_eggs(attrs['setup_requires'])
      File "/Users/user/Documents/virtualenv/lib/python3.6/site-packages/setuptools/dist.py", line 371, in fetch_build_eggs
        replace_conflicting=True,
      File "/Users/user/Documents/virtualenv/lib/python3.6/site-packages/pkg_resources/__init__.py", line 846, in resolve
        dist = best[req.key] = env.best_match(req, ws, installer)
      File "/Users/user/Documents/virtualenv/lib/python3.6/site-packages/pkg_resources/__init__.py", line 1118, in best_match
        return self.obtain(req, installer)
      File "/Users/user/Documents/virtualenv/lib/python3.6/site-packages/pkg_resources/__init__.py", line 1130, in obtain
        return installer(requirement)
      File "/Users/user/Documents/virtualenv/lib/python3.6/site-packages/setuptools/dist.py", line 439, in fetch_build_egg
        return cmd.easy_install(req)
      File "/Users/user/Documents/virtualenv/lib/python3.6/site-packages/setuptools/command/easy_install.py", line 668, in easy_install
        raise DistutilsError(msg)
    distutils.errors.DistutilsError: Could not find suitable distribution for Requirement.parse('incremental>=16.10.1')

    ----------------------------------------
Command "python setup.py egg_info" failed with error code 1 in /private/var/folders/45/r4yr9bbj29dfbtxqv75_785m0000gn/T/pip-build-02d49zb3/twisted/
(virtualenv) user@host:~/Documents/virtualenv$ 

[psbj]

I had this issue as well.

The problem seems to stem from the ssl module not being enabled when building Python 3.6.0.

I got around this by uncommenting lines 209-212 in Python-3.6.0/Modules/Setup

SSL=/usr/local/ssl
_ssl _ssl.c \
        -DUSE_SSL -I$(SSL)/include -I$(SSL)/include/openssl \
        -L$(SSL)/lib -lssl -lcrypto

and make sure libssl-dev is installed (this is the package for debian, anyway).

Once that's done, do ./configure, make, and make install again and it should work.

[ruipacheco]

I have the exact same issue on Python 3.5, latest OSX:

$ pip install pip --upgrade
Could not fetch URL https://pypi.python.org/simple/pip/: There was a problem confirming the ssl certificate: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:720) - skipping

I fixed it by using the trusted host parameter:

$ pip install --trusted-host pypi.python.org pip --upgrade
Requirement already up-to-date: pip in ./venv/lib/python3.5/site-packages

[tiran]

I would not call --trusted-host a fix. At best it is a dangerous workaround. You are disabling TLS verification and open up your computer to man-in-the-middle attacks. The option should have been called --bypass-insecure-host or similar.

[dstufft]

The issue here is that setuptools is trying to talk to PyPI, not pip, and that 3.6.0 on macOS does not have access to a CA Bundle by default and setuptools doesn't bundle one like pip does. You'll need to install something like certifi or raise an issue with setuptools.

[CallenChen]

pip install incremental

[inakidelamadrid]

You're a hero @CallenChen

[Aaliaan]

Still doesn't work, please help...

C:\Windows\system32>pip install incremental
Collecting incremental
Could not fetch URL https://pypi.python.org/simple/incremental/: There was a problem confirming the ssl certificate: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:748) - skipping
Could not find a version that satisfies the requirement incremental (from versions: )
No matching distribution found for incremental

[iZsh]

on OSX, using macport, installing curl-ca-bundle solves it:

sudo port install curl-ca-bundle

[krared]

brew update
brew uninstall openssl
brew install openssl
echo 'export PATH="/usr/local/opt/openssl/bin:$PATH"' >> ~/.bash_profile

[gitanupam]

how about just installing certifi as mentioned here (this link appears soon after one installs Python 3.6)?

pip install certifi

[millicentachieng]

@gitanupam Installing certifi worked for me.

[hadifarnoud]

none of the solutions worked for me. I'm on OSX

[sdk21]

Try installing new version of pip directly using get-pip.py (see https://pip.pypa.io/en/stable/installing/)

$ curl 'https://bootstrap.pypa.io/get-pip.py' > get-pip.py
$ sudo python get-pip.py

(formatted by @pradyunsg)

[k-k-s-s]

@sdk21 this works for me. thx

[mimoralea]

Not sure why, perhaps because of Pypi no longer accepting http connections... But changing the mirror works for me:

$ cat ~/.config/pip/pip.conf
[global]
proxy = http://my-proxy:8080
index-url = http://mirrors.aliyun.com/pypi/simple/
trusted-host = mirrors.aliyun.com

[gitanupam]

PyPI is accepting HTTP connections but have recently stopped support for TLS v1.0 and v1.1. See https://stackoverflow.com/a/49769015/1526703

[mimoralea]

Thanks for the clarification, @gitanupam

[aaazzz]

Thanks @sdk21! It works for me!

[WaddleSam]

@sdk21 This works for me. Thanks!

[zgfh]

@sdk21 This works for me. Thanks!

[lblamar]

Thanks @sdk21 solve it...

[mescalito]

on mac, I did this and finally worked out:
https://pip.readthedocs.io/en/stable/installing/

[nirmineigue]

@sdk21 thanks, it works for me 👍