pip install fails with “connection error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:598)”

administrator 提交于 2018-03-17 00:23:17


I am very new to Python and trying to > pip install linkchecker on Windows 7. Some notes:

  • pip install is failing no matter the package. For example, > pip install scrapy also results in the SSL error.
  • Vanilla install of Python 3.4.1 included pip 1.5.6. The first thing I tried to do was install linkchecker. Python 2.7 was already installed, it came with ArcGIS. python and pip were not available from the command line until I installed 3.4.1.
  • > pip search linkchecker works. Perhaps that is because pip search does not verify the site's SSL certificate.
  • I am in a company network but we do not go through a proxy to reach the Internet.
  • Each company computer (including mine) has a Trusted Root Certificate Authority that is used for various reasons including enabling monitoring TLS traffic to Not sure if that has anything to do with it.

Here are the contents of my pip.log after running pip install linkchecker:

Downloading/unpacking linkchecker
  Getting page
  Could not fetch URL connection error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:598)
  Will skip URL when looking for download links for linkchecker
  Getting page
  Could not fetch URL connection error: HTTPSConnectionPool(host='', port=443): Max retries exceeded with url: /simple/ (Caused by : Request-sent)
  Will skip URL when looking for download links for linkchecker
  Cannot fetch index base URL
  URLs to search for versions for linkchecker:
  Getting page
  Could not fetch URL connection error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:598)
  Will skip URL when looking for download links for linkchecker
  Could not find any downloads that satisfy the requirement linkchecker
Cleaning up...
  Removing temporary dir C:\Users\jcook\AppData\Local\Temp\pip_build_jcook...
No distributions at all found for linkchecker
Exception information:
Traceback (most recent call last):
  File "C:\Python34\lib\site-packages\pip\", line 122, in main
    status =, args)
  File "C:\Python34\lib\site-packages\pip\commands\", line 278, in run
    requirement_set.prepare_files(finder, force_root_egg_info=self.bundle, bundle=self.bundle)
  File "C:\Python34\lib\site-packages\pip\", line 1177, in prepare_files
    url = finder.find_requirement(req_to_install, upgrade=self.upgrade)
  File "C:\Python34\lib\site-packages\pip\", line 277, in find_requirement
    raise DistributionNotFound('No distributions at all found for %s' % req)
pip.exceptions.DistributionNotFound: No distributions at all found for linkchecker


New Answer:

The Python Package Index no longer supports http connections. You can ignore SSL errors by setting as the trusted source.

pip install --trusted-host 

Old Answer:

Most of the answers could pose a security issue.

Two of the workarounds that help in installing most of the python packages with ease would be:

  • Using easy_install: if you are really lazy and don't want to waste much time, use easy_install . Note that some packages won't be found or will give small errors.
  • Using Wheel: download the Wheel of the python package and use the pip command pip install wheel_package_name.whl to install the package.


kenorb’s answer is very useful (and great!).
Among his solutions, maybe this is the most simple one: --trusted-host

For example, in this case you can do

pip install --trusted-host linkchecker

The pem file(or anything else) is unnecessary.


You can specify a cert with this param:

pip --cert /etc/ssl/certs/FOO_Root_CA.pem install linkchecker

See: Docs » Reference Guide » pip

If specifying your company's root cert doesn't work maybe the cURL one will work:

You must use a PEM file and not a CRT file. If you have a CRT file you will need to convert the file to PEM

Also check: SSL Cert Verification.


The most straightforward way I've found, is to download and use the "DigiCert High Assurance EV Root CA" from DigiCert at

You can visit to verify the cert issuer by clicking on the lock icon in the address bar, or increase your geek cred by using openssl:

$ openssl s_client -connect
depth=1 /C=US/O=DigiCert Inc/ SHA2 Extended Validation Server CA
verify error:num=20:unable to get local issuer certificate
verify return:0
Certificate chain
 0 s:/businessCategory=Private Organization/ Allen Rd/postalCode=03894-4801/C=US/ST=NH/L=Wolfeboro,/O=Python Software Foundation/
   i:/C=US/O=DigiCert Inc/ SHA2 Extended Validation Server CA
 1 s:/C=US/O=DigiCert Inc/ SHA2 Extended Validation Server CA
   i:/C=US/O=DigiCert Inc/ High Assurance EV Root CA

The last CN value in the certificate chain is the name of the CA that you need to download.

For a one-off effort, do the following:

  1. Download the CRT from DigiCert
  2. Convert the CRT to PEM format
  3. Export the PIP_CERT environment variable to the path of the PEM file

(the last line assumes you are using the bash shell) before running pip.

curl -sO 
openssl x509 -inform DES -in DigiCertHighAssuranceEVRootCA.crt -out DigiCertHighAssuranceEVRootCA.pem -text
export PIP_CERT=`pwd`/DigiCertHighAssuranceEVRootCA.pem

To make this re-usable, put DigiCertHighAssuranceEVRootCA.crt somewhere common and export PIP_CERT accordingly in your ~/.bashrc.


You've the following possibilities to solve issue with CERTIFICATE_VERIFY_FAILED:

  • Use HTTP instead of HTTPS.
  • Use --cert or CA_BUNDLE variable to specify alternative CA bundle.

    E.g. you can go to failing URL from web-browser and import root certificate into your system.

  • Run python -c "import ssl; print(ssl.get_default_verify_paths())" to check the current one (validate if exists).

  • OpenSSL has a pair of environments (SSL_CERT_DIR, SSL_CERT_FILE) which can be used to specify different certificate databasePEP-476.
  • Use --trusted-host to mark the host as trusted.
  • In Python use verify=False for requests.get (see: SSL Cert Verification).
  • Use --proxy to avoid certificate checks.

Read more at: TLS/SSL wrapper for socket objects - Verifying certificates.


You can try to bypass the SSL error by using http instead of https. Of course this is not optimal in terms of security, but if you are in a hurry it should do the trick:

pip install --index-url= linkchecker


To solve this problem once and for all, you can verify that you have a pip.conf file.

This is where your pip.conf should be, according to the documentation:

On Unix the default configuration file is: $HOME/.config/pip/pip.conf which respects the XDG_CONFIG_HOME environment variable.

On macOS the configuration file is $HOME/Library/Application Support/pip/pip.conf.

On Windows the configuration file is %APPDATA%\pip\pip.ini.

Your pip.conf should look like:

trusted-host =

pip install linkchecker installed linkchecker without complains after I created the pip.conf file.


I recently ran into this problem because of my company's web content filter that uses its own Certificate Authority so that it can filter SSL traffic. PIP doesn't seem to be using the system's CA certificates in my case, producing the error you mention. Downgrading PIP to version 1.2.1 presented its own set of problems later on, so I went back to the original version that came with Python 3.4.

My workaround is quite simple: use easy_install. Either it doesn't check the certs (like the old PIP version), or it knows to use the system certs because it works every time for me and I can still use PIP to uninstall packages installed with easy_install.

If that doesn't work and you can get access to a network or computer that doesn't have the issue, you could always setup your own personal PyPI server: how to create local own pypi repository index without mirror?

I almost did that until I tried using easy_install as a last ditch effort.


Inorder to get over the ssl verification issue,

this is something I have tried and worked. I was getting error when I was trying to install ansible so I put ansible in package name.

This tells pip to trust the host from which we download and to trust it with our package.

pip install --trusted-host ansible

pip install --trusted-host --upgrade pip


I installed pip 1.2.1 with easy_install and upgraded to latest version of pip (6.0.7 at the time) which is able to install packages in my case.

easy_install pip==1.2.1
pip install --upgrade pip


Had the same problem trying pip install ftputil with ActivePython 2.7.8, ActivePython 3.4.1, and "stock" Python 3.4.2 on 64-bit Windows 7 Enterprise. All attempts failed with the same errors as OP.

Worked around the problem for Python 3.4.2 by downgrading to pip 1.2.1: easy_install pip==1.2.1 (see Same fix also worked for ActivePython 2.7.8.

The bug, reported in March 2013, is still open:


I solved this problem by removing my pip and installing the older version of pip:


You can try this to ignore "https":

pip install --index-url= --trusted-host  [your package..]


for me this is because previously I'm running script which set proxy (to fiddler), reopening console or reboot fix the problem.


Recently I faced the same issue in python 3.6 with visual studio 2015. After spending 2 days, I got the solution and its working fine for me.

I got below error while try to install numpy using pip or from visual studio Collecting numpy Could not fetch URL There was a problem confirming the ssl certificate: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:748) - skipping Could not find a version that satisfies the requirement numpy (from versions: ) No matching distribution found for numpy

Resolution :

For Windows OS

  1. open -> "%appdata%" Create "pip" folder if not exists.
  2. In pip folder create "pip.ini" file.
  3. Edit file and write
    trusted-host = Save and Close the file. Now install using pip/visual studio it works fine.


For me none of the suggested methods worked - using cert, HTTP, trusted-host.

In my case switching to a different version of the package worked (paho-mqtt 1.3.1 instead of paho-mqtt 1.3.0 in this instance).

Looks like problem was specific to that package version.


In my case, I was running Python in the minimal alpine docker image. It was missing root CA certificates. Fix:

apk update && apk add ca-certificates


In my case I observed that pip failed when installing a related package. In my case the python-heatclient required positional, which required pbr. The install of pbr was failing. When I installed pbr explicitly before installing python-heatclient, it worked as expected.

Call that failed venv/bin/pip install python-heatclient

Calls that succeeded

venv/bin/pip install pbr

venv/bin/pip install python-heatclient