Unable to Get Local Issuer Certificate Python: 5 Proven Fixes (2026)

What Does “Unable to Get Local Issuer Certificate” Python Error Mean?

When Python makes an HTTPS request, OpenSSL tries to verify the server’s certificate by building a complete trust chain back to a trusted root Certificate Authority (CA). If it cannot find the intermediate or root CA in its local trust store, OpenSSL throws:

unable to get local issuer certificate

In simple terms: Python doesn’t trust the server because a required certificate is missing from its bundle.

Why This Error Happens: Root Causes Explained

The error message – [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate – stems from Python’s OpenSSL backend failing to locate or trust the issuer’s root CA in its certificate bundle. Common culprits include:

5 Quick Fixes for Resolving “Unable to Get Local Issuer Certificate”

This section covers five practical, actionable fixes to resolve the SSL certificate verification error in Python across different platforms and situations.

Quick Fix #1: Install Missing Certificates on macOS

If you use the default Python installer on macOS, run the bundled script to install necessary certificates:

/Applications/Python\ 3.x/Install\ Certificates.command

This script installs or updates the root CA certificates recognized by Python. If it fails, ensure Python is installed correctly and permissions allow script execution.

Quick Fix #2: Install Certifi Package (All Platforms)

Certifi provides an updated Mozilla CA bundle for Python:

pip install --upgrade certifi

import certifi
import requests

response = requests.get('https://example.com', verify=certifi.where())

export SSL_CERT_FILE=$(python -m certifi)

setx SSL_CERT_FILE (python -m certifi)

This script installs or updates the root CA certificates recognized by Python. If it fails, ensure Python is installed correctly and permissions allow script execution.

Quick Fix #3: Update System CA Certificates

Updating system certificates often resolves chain issues.

macOS: Updating system certificates

sudo security delete-certificate -Z 
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain 

Windows: Certificate store management

Add/custom root certificate:

certutil -addstore -f "Root" company_root.cer

Linux: ca-certificates package update

Debian/Ubuntu:

sudo apt-get update && sudo apt-get install --reinstall ca-certificates
sudo update-ca-certificates

sudo yum reinstall ca-certificates
sudo update-ca-trust

Quick Fix #4: Configure Custom Certificate Path

Useful for:

import certifi
print(certifi.where())

export REQUESTS_CA_BUNDLE=$(python -m certifi)
export SSL_CERT_FILE=$(python -m certifi)

requests.get("https://example.com", verify=certifi.where())

Quick Fix 5: Install python-certifi-win32 (The Windows Magic Fix)

Windows Python completely ignores the Windows certificate store by default.

pip install python-certifi-win32

How it works?

Integration with requests library

Once installed, no code changes are required. Requests automatically uses updated certs.

How to Fix “Unable to Get Local Issuer Certificate” in pip

pip install failures

pip install failures often happen due to missing or outdated CA certificates.

If your issue appears specifically during pip install, you can also refer to our detailed guide on fixing the pip SSL Certificate_Verify_Failed error, which explains pip-specific causes and solutions in depth.

Permanent pip configuration

Add to pip.ini (Windows):

[global] 
cert = <path-to-cert.pem>

Linux/macOS:

mkdir -p ~/.config/pip
nano ~/.config/pip/pip.conf

Add:

[global]
cert = /path/to/cert.pem

Using –trusted-host flag

Temporary workaround:

pip install <package> --trusted-host pypi.org --trusted-host files.pythonhosted.org

Corporate Network and Proxy Solutions

If behind a corporate proxy:

export SSL_CERT_FILE=/path/to/corporate-ca-bundle.pem

How to Prevent Future Certificate Issues

Regular certificate updates

Update certifi monthly:

pip install --upgrade certifi

Monitoring certificate expiration

Use:

openssl x509 -enddate -noout -in cert.pem

Best practices for Python SSL

Advanced: Building Python with SSL Support

When SSL module is missing

You may see:

ssl module in Python is not available

Meaning Python was compiled without OpenSSL.

Compiling Python with OpenSSL

Linux example:

sudo apt-get install libssl-dev
./configure --with-openssl
make
sudo make install

Our Expert Insights: Preventing Recurrence in Your Workflow

From auditing 50+ Python projects, I recommend:

Secure Your Python HTTPS Calls Today

The “unable to get local issuer certificate” error doesn’t have to sideline your Python projects. Start with updating certifi for quick wins, then layer in environment vars or contexts for robustness. By prioritizing security, you’ll build resilient code that scales from local scripts to global cloud apps. Implement one fix now, test thoroughly, and share your success – your future self (and team) will thank you. For more Python security tips, check my guide on secure API integrations.

Best Code Signing Certificates for Python Applications

Priya Mervana

Verified Web Security Experts

Priya Mervana is working at SSLInsights.com as a web security expert with over 10 years of experience writing about encryption, SSL certificates, and online privacy. She aims to make complex security topics easily understandable for everyday internet users.