Python pip SSL Certificate_Verify_Failed Error: Complete Fix (2026 Guide)

Verified by SSL Insights Editorial Team - Last reviewed: July 2026 | Based on 10+ years across SSL/TLS and web security.

Quick Answer
CERTIFICATE_VERIFY_FAILED is the error pip raises when Python's SSL layer cannot confirm that a server's certificate chains back to a trusted root authority. It happens during the TLS handshake, before any package data downloads. No valid trust chain means no install - regardless of connection speed.

Quick Verdict

• Try these fixes in order:
• Update pip and certifi
• Refresh your operating system's trusted root certificates
• Verify that Python includes OpenSSL support
• Configure a custom CA bundle if you're behind a corporate proxy

Bottom-Line Recommendation

Most pip SSL certificate verification errors are caused by certificate trust issues rather than pip itself. Updating your CA bundle and verifying your Python SSL configuration permanently resolves the majority of cases.

pip install SSL: CERTIFICATE_VERIFY_FAILED happens when Python cannot verify the certificate presented by PyPI or files.pythonhosted.org during the TLS handshake. The three most common causes are an outdated system CA bundle, a corporate proxy intercepting HTTPS traffic, and a Python build missing OpenSSL support. Updating pip and certifi, refreshing OS root certificates, or pointing pip at a custom CA bundle resolves most cases. The exact steps differ slightly across Windows, macOS, and Linux - including inside a virtual environment - and this guide covers each platform along with corporate-network scenarios.

Why Does Pip Show SSL: CERTIFICATE_VERIFY_FAILED?

pip communicates with PyPI over HTTPS, relying on the system's or Python's own CA bundle to confirm the server's identity before any package data transfers. OpenSSL checks four things during that handshake: the certificate issuer, its expiration date, the trust chain back to a root CA, and the domain match. If any one of those checks fails, pip stops the install and raises the error rather than downloading over an unverified connection.

Certificate infrastructure has also gotten less forgiving. As of March 2026, the CA/Browser Forum cut the maximum lifetime of publicly trusted TLS certificates from 398 days to 200 days, with further cuts to 100 days in 2027 and 47 days by 2029. Environments that pin an old CA bundle or haven't refreshed root certificates in a while are more likely to hit expired or untrusted chains than they were a few years ago.

Diagnostic Tip: Run python -m ssl before touching any fix. If it errors instead of printing version info, the issue is a missing OpenSSL build, not an outdated certificate - and no amount of certifi upgrades will resolve it.

Common triggers include an outdated or missing system CA bundle, a corporate proxy performing SSL interception, an incorrect system clock, a Python interpreter built without SSL support, and custom CA bundles pip doesn't recognize.

Quick Fix: The --trusted-host Flag (Temporary Only)

pip install package_name --trusted-host pypi.org --trusted-host files.pythonhosted.org

This is a legitimate emergency option - useful when you're troubleshooting a broken chain or stuck behind a restrictive firewall and need a package installed right now. It is not a fix.

Is it safe to use the pip trusted-host flag long-term? No - it bypasses certificate validation entirely, exposing the connection to man-in-the-middle attacks, and it's rejected by most CI/CD pipelines and production environments for exactly that reason.

How to Update pip and Certifi

Python ecosystem - it pulled in over 1.7 billion downloads in the last 30 days alone, with releases shipped roughly monthly to track CA changes. Verify the install worked with python -m certifi, then troubleshoot the python -m certifi command further if pip still reaches for an old bundle:

export SSL_CERT_FILE=$(python -m certifi)

On Windows, point SSL_CERT_FILE at the certifi cache path under your Python install directory instead.

How to Fix pip SSL Certificate_Verify_Failed on Windows

How to Fix pip SSL Certificate_Verify_Failed on macOS and Linux

On macOS

/Applications/Python*/Install Certificates.command

On Ubuntu or Debian

sudo apt-get install --reinstall ca-certificates
sudo update-ca-certificates

On RHEL, CentOS, or Fedora

sudo yum reinstall ca-certificates

sudo apt install libssl-dev libffi-dev python3-dev

brew reinstall python

Expert Fix If you manage multiple servers, standardize on one CA bundle source - either the OS trust store or certifi, not both. Mixing them is a frequent cause of intermittent, hard-to-reproduce SSL failures across a fleet.

Configuring pip With a Custom CA Bundle

pip config set global.cert /path/to/ca-bundle.crt

For a persistent setting, create ~/.config/pip/pip.conf on Linux/macOS or %APPDATA%\pip\pip.ini on Windows with a [global] section pointing cert at your bundle. The environment-variable method works everywhere: export REQUESTS_CA_BUNDLE=/path/to/ca-bundle.crt.

Pip SSL Error Behind a Corporate Proxy

Export your organization's root CA from the browser (Chrome/Edge: Settings → Privacy & Security → Manage Certificates → Export), then reference it the same way - pip config set global.cert C:/certs/company-rootCA.pem - or test it inline with pip install requests --cert C:/certs/company-rootCA.pem. This is also how to add a company CA certificate to pip on Windows machines managed by corporate IT: pip install pip-system-certs forces pip to read from the Windows certificate store directly, which is often faster than managing a standalone bundle file.

Root Cause Insight Corporate SSL interception isn't a misconfiguration - it's often deliberate proxy inspection. The fix isn't to bypass validation; it's to teach pip to trust the proxy's own root certificate, the same way your browser already does.

Conda vs Pip SSL Error: When to Switch

For scientific stacks (NumPy, SciPy, TensorFlow) or environments where compiling from source keeps failing, conda install package_name sidesteps pip's SSL chain entirely by using precompiled binaries. Conda supports its own custom CA bundle via conda config --set ssl_verify /path/to/ca.pem and tends to be more resilient behind corporate proxies, though it comes with a larger footprint and less flexibility for pure-Python projects than pip.

Troubleshooting Persistent pip SSL Errors

If none of the above resolves it, check what Python is actually running:

python -c "import ssl; print(ssl.OPENSSL_VERSION)"

Confirm it reports 1.1.1 or newer. Then test the network path directly with curl https://pypi.org/simple/ or openssl s_client -connect pypi.org:443 to rule out a firewall or DNS issue masquerading as an SSL error. If you're also hitting the related "Unable to Get Local Issuer Certificate" message, see our Unable to Get Local Issuer Certificate Python – Complete Fix guide, or check self-signed certificate chain errors if the chain includes an internal CA.

Final Thoughts

pip's SSL: CERTIFICATE_VERIFY_FAILED error almost always traces back to certificate trust - an outdated bundle, a network device intercepting the connection, or a Python build missing OpenSSL. Updating certifi, refreshing system certificates, and configuring pip's CA bundle correctly resolve it permanently across Windows, macOS, Linux, and pip SSL errors inside a virtual environment, without resorting to --trusted-host as anything more than a stopgap.

Permanent fixes always involve restoring certificate trust - not bypassing it. If certificate verification fails, identify the trust problem rather than disabling TLS validation.

Frequently Asked Questions

How do I fix SSL certificate verification failed in pip?

Update pip and certifi first with python -m pip install --upgrade pip certifi, then refresh your system's root certificates. The --trusted-host flag works as a temporary bypass only.

Why does pip show SSL certificate error?

Pip can't verify PyPI's certificate - usually from an outdated CA bundle, a wrong system clock, or a proxy intercepting the connection.

How do I disable SSL verification in pip?

Add --trusted-host pypi.org --trusted-host files.pythonhosted.org to the command. This is a reduced-security workaround, not a permanent solution.

How do I update the pip SSL certificate?

Run pip install --upgrade certifi, then set SSL_CERT_FILE to point at the new bundle path returned by python -m certifi.

Python ssl certificate expired fix - what should I check first?

Confirm your system date and time are correct, since a wrong clock triggers the same error as a genuinely expired certificate. Then update pip and reinstall CA certificates.

Curl vs pip SSL certificate_verify_failed - same root cause?

Usually yes. Both curl and pip validate against CA bundles independently, so a curl failure alongside a pip failure points to a system-level trust store issue rather than a Python-only bug.

Can I permanently ignore SSL verification in pip?

Technically yes, but it isn't safe - it strips the protection against tampered downloads and fails compliance checks like PCI DSS or SOC 2. Fix the certificate chain instead.

How do I fix pip SSL error in Windows 10?

Install Python from the official Windows installer, run pip install certifi, and update root certificates through Windows Update.