Fix certificate verification failures in pip

Start with the complete verification error, system clock, configured package index, and any HTTPS proxy. Repair the chain or trust configuration that the connection actually needs. Using --trusted-host to download packages through a failing TLS connection does not repair that trust relationship.

Identify pip's interpreter and trust source

python -m pip --version
python -m pip config debug

Inspect configuration locally; redact credentials and private endpoints before sharing diagnostics. For pip 24.2+ on Python 3.10+, system certificates are used alongside certifi by default. Older combinations differ. A standalone upgrade of the environment's certifi package may not update the certificate components bundled with pip.

Once verified connectivity is available, update the selected environment as appropriate:

python -m pip install --upgrade pip
python -m pip install --upgrade certifi

If HTTPS still fails, use an independently verified CA bundle or an approved offline artifact process first. Downloading the repair over an unverified connection defeats the purpose.

Configure a private or enterprise CA

Obtain the CA through the organization's trusted PKI channel and verify its fingerprint. A certificate copied from the failing connection is evidence to inspect, not a reason to trust it automatically.

For a shell session:

export PIP_CERT=/path/to/approved-ca-bundle.pem
python -m pip install requests

Or put the setting in the appropriate pip configuration file:

[global]
cert = /path/to/approved-ca-bundle.pem

The bundle must support the actual index and artifact-download endpoints. Avoid assuming a single private root covers every public endpoint used during installation. On Debian-family systems, an approved local CA can also be installed through that distribution's system trust procedure; whether pip uses it depends on the interpreter and pip version.

Check installation-specific causes

For a python.org macOS installation that provides this script, run the matching version, for example:

open "/Applications/Python 3.12/Install Certificates.command"

That path is installation-specific. The script may need verified network access to install certifi; it is not a universal fix for every Python distribution or corporate proxy.

FAQ

Why can the browser open the site?

The browser and pip may have different trust stores, cached intermediates, proxy settings, or endpoints. Browser success does not establish that pip has a valid chain for every download host.

Should I change mirrors?

Only to an approved source with valid HTTPS. That changes your package supply chain and cannot fix an incorrectly trusted proxy or hostname mismatch. Remove obsolete trusted-host overrides once proper trust is configured.

What should I check in Docker?

Minimal images may lack ca-certificates. Install the distribution's CA package, such as the Debian or Alpine package, and verify Python can use it. Package presence alone does not fix private CA, expiry, or server-chain problems.

References: pip HTTPS trust configuration, pip configuration, Using Python on macOS.