104

Many operations in Python require accessing things via https. This includes pip install command, or just using http.client.HTTPSConnection, or any modules or applications that use these things internally.

If python was installed from the official python pkg installer, downloaded from https://python.org, then it uses an internal version of openssl, and contains no root certificates. Anything that uses an SSL connection results in this error:

ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:749)

How can I install root certs to make the above error go away?

1

17 Answers 17

233

When you run the python installer, they display this information to you. It is also documented in /Applications/Python 3.6/ReadMe.rtf, but it's very easily overlooked.

Just browse to Applications/Python 3.6 and double-click Install Certificates.command

There is an issue in the Python bug tracker about this. http://bugs.python.org/issue29480

Update: This issue is marked as resolved in the bug tracker with this text being part of the latest comment:

... For 3.7.0b2, I have tried to make things more obvious in two ways. One, the installer package will now attempt to open a Finder window for the /Application/Python 3.7 folder that contains the "Install Certificates.command". Two, rather than just a generic "installation complete" message at the end of the install, there is now a tailored message that urges the user to click on the "Install Certificates.command" icon. ...

15
  • 2
    Is there a solution, if one doesn't have root access? Thanks. May 18, 2017 at 22:08
  • 4
    I ran the Install Certificates.command file but the error persists (in Py36) if I use an https URL in my code (to read content). If I use the same URL string minus the "s" (e.g., http), my code works. Unfortunately, I need https for some URLs. Any suggestion for this? (I also ran "pip3 install --upgrade certifi" because I need both Py27 and Py36 running)
    – ultrageek
    Feb 13, 2018 at 0:57
  • 2
    This does not work; all errors persist, just as @ultrageek mentions. Also, please list the actual command instead of the alias that is bundled with a specific version of Python. -1.
    – hpm
    Dec 2, 2018 at 12:39
  • 17
    I don't have Python in my Applications folder
    – flppv
    Apr 9, 2019 at 9:44
  • 3
    @gma992 I installed python through homebrew and pyenv. I don't see an Install Certificaters command in the directory where my python version is stored. Aug 10, 2021 at 16:43
53

I solved this problem using this command:

open /Applications/Python\ 3.7/Install\ Certificates.command

I have Python 3.7 in my machine.

Check this link - Fixing CERTIFICATE_VERIFY_FAILED error when trying requests-html out on Mac

1
  • I have python3.9 and just changing the 7 for the 9 works, thank you! May 17, 2022 at 1:48
47

Cool way to solve this issue for all your python version and without checking your version on macOS

bash /Applications/Python*/Install\ Certificates.command

This command is equivalent to:

...
bash /Applications/Python\ 2.7/Install\ Certificates.command
bash /Applications/Python\ 3.6/Install\ Certificates.command
bash /Applications/Python\ 3.7/Install\ Certificates.command
...

It helped me hope it will help you as well

4
  • % python3 get-pip.py --> WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:992)'))': /simple/pip/ Could not fetch URL pypi.org/simple/pip: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/pip/ (Caused by SSLError(SSLCertVerificationError(1, Oct 25, 2022 at 10:48
  • '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:992)'))) - skipping ERROR: Could not find a version that satisfies the requirement pip (from versions: none) Oct 25, 2022 at 10:48
  • bash /Applications/Python*/Install\ Certificates.command -- pip install --upgrade certifi /Library/Frameworks/Python.framework/Versions/3.11/bin/python3.11: No module named pip Traceback (most recent call last): File "<stdin>", line 44, in <module> File "<stdin>", line 24, in main File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/subprocess.py", line 413, in check_call raise CalledProcessError(retcode, cmd) subprocess.CalledProcessError: Command ' Oct 25, 2022 at 10:49
  • ['/Library/Frameworks/Python.framework/Versions/3.11/bin/python3.11', '-E', '-s', '-m', 'pip', 'install', '--upgrade', 'certifi']' returned non-zero exit status 1. Oct 25, 2022 at 10:49
36

If pip does not fix the issue

pip3 install --upgrade certifi

Then try the following scripts if you can't find the "Install Certificates.command"

#!/usr/bin/env python3
# install_certifi.py
#
# sample script to install or update a set of default Root Certificates
# for the ssl module.  Uses the certificates provided by the certifi package:
#       https://pypi.python.org/pypi/certifi

import os
import os.path
import ssl
import stat
import subprocess
import sys

STAT_0o775 = ( stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR
             | stat.S_IRGRP | stat.S_IWGRP | stat.S_IXGRP
             | stat.S_IROTH |                stat.S_IXOTH )


def main():
    openssl_dir, openssl_cafile = os.path.split(
        ssl.get_default_verify_paths().openssl_cafile)

    # +++> if already done  <----
    #print(" -- pip install --upgrade certifi")
    #subprocess.check_call([sys.executable,
    #    "-E", "-s", "-m", "pip", "install", "--upgrade", "certifi"])

    import certifi
    # change working directory to the default SSL directory
    os.chdir(openssl_dir)
    relpath_to_certifi_cafile = os.path.relpath(certifi.where())
    print(" -- removing any existing file or link")
    try:
        os.remove(openssl_cafile)
    except FileNotFoundError:
        pass
    print(" -- creating symlink to certifi certificate bundle")
    os.symlink(relpath_to_certifi_cafile, openssl_cafile)
    print(" -- setting permissions")
    os.chmod(openssl_cafile, STAT_0o775)
    print(" -- update complete")

if __name__ == '__main__':
    main()
11
  • 2
    Thanks. Worked for me. Probably the only solution that will work in many cases.
    – Mercado
    May 11, 2020 at 14:11
  • Works on ubuntu too! Thank god
    – Rotartsi
    Jun 18, 2020 at 1:04
  • Even though I found Install Certificates.command, I had to run this script to solve the problem. I had b0rked my environment pretty good with an overzealous find ... -delete which may have contributed. Aug 19, 2020 at 21:56
  • I've had this problem intermittently for years, and this script solved it. You are a hero amongst developers.
    – Tom Swirly
    Oct 29, 2020 at 18:01
  • Spent a few hours on this and tried many other SO solutions... this is the only one that worked. I'm on Python 3.8 installed with Homebrew.
    – Justin
    Jun 10, 2021 at 21:13
6

In my case none of the solutions worked with the system installed python3 in macOS Catalina, neither did it work with python3 installed via brew.

If someone has a situation like this and wants a quick solution,
Download and install python3 again, using https://www.python.org/downloads/

At the end of the installation, the installer would show you a note, asking to run the Install Certificates.command file.
(With the other installations, this file was not present, and neither was the solution with the file's source code working)

Restart the terminal, and you can type where python3, to see /Library/Frameworks/Python.framework/Versions/3.8/bin/python3. Using this binary, the problem should not occur.

Note: It might be possible to make the system-installed python3 work, but in my case; it proved to be extremely hard, so I choose this way.

1
  • 1
    This led me to the correct solution on Catalina when trying to get my bitbar python3 plugins working. I saw I had a couple python3 installations with which python3 and changing the script shebang to #!/usr/local/bin/python3 fixed the SSL errors. Thanks!
    – Michael
    Dec 10, 2019 at 16:35
4

If you're using MacOS go to Applications >> python3.8 >> and double-click Install Certificates.command. This worked for me.

3

I faced the same problem, when I tried to run Python with Keras data loading. The error for me was:

Exception: URL fetch failure on AWS_URL: None -- [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:833)

I fixed my problem by upgrading the certificate as:

pip install --upgrade certifi
3
  • Hi! It is pip install --upgrade certificate isn't it? I made an edit to your post, but wasn't sure if this is a spelling mistake or a module I don't know.
    – creyD
    Jun 20, 2019 at 14:44
  • Or is it this module? Then please feel free to correct it!
    – creyD
    Jun 20, 2019 at 16:13
  • 3
    It’s not a spelling mistake, but just a module name.
    – Ratha Pech
    Jun 22, 2019 at 13:26
2

Confirm you are not in a virtualenv. I tried the above without success, only to realise my installations were failing because I was on a virtualenv

2
  • How to make it work in virtual environments? Feb 7 at 8:39
  • @ValentinoPereira check the python version in the virtual env, and try update it using "/Applications/Python {version}/Install Certificates.command"
    – StackEdd
    Mar 3 at 7:25
1

A cheap way around this is just using python3.5 if you still have it installed.

Pushing to PyPI:

python3.5 setup.py register -r pypitest

python3.5 setup.py sdist upload -r pypitest

pipping seems to work fine with 3.6 out of the box..

0

Ensure that you do not have SSL_CERT_FILE environment variable set. I had the same problem, it took a while before I figured out some application was setting this variable as an empty string inside my bash profile.

0

I had the same issue with macOS Big Sur. Here is what I did to solve the issue.

IDE - Pycharm

Python Version Downloaded - 3.9.6

  • Download the latest python version and remove the earlier version
  • While installation, at the end (Summary Section), there is a small note to install an SSL Certificate. Read that Summary section carefully.
  • Double click the SSL Certificate path provided in the summary
  • It will take you to the respective folder where there should be one file named - "Install Certificate Command"
  • Double click on that file, it should open the terminal and will run the code automatically. Wait till you receive the message as "[Completed Successfully]".
  • Once done close and restart terminal/IDE and this should resolve your issue.

Note: if you have anaconda and python both installed on your system then check whether you are using the correct python version in the IDE which the latest version downloaded and not from Anaconda.

Enjoy.

0

I needed to add my corporate CA certs into the python CA cert file due to corporate SSL gateways.

The location of the CA cert file is found by

import ssl
print(ssl.get_default_verify_paths().openssl_cafile)

The cert to be added was in keychain. After exporting it, it needed converting into PEM format so it could be cut & pasted into the cacert file -

openssl x509 -inform der -in cert.cer -out cert.pem
-1

For me, it was a misspecification of the request. I'd made a https call instead of a http call. Changing to http solved it.

-1

Just REINSTALL your Python on your Mac

-1

sometimes if you're using conda or poetry you may be in a virtual environment shell. you can check with:

which python

for me the solution was as simple as cmd+t to open a new shell.

-1

I did this and it worked on my Mac: Macintoch HD>Applications>Python file>Install Certificates.command (double click on it)

-3

If you're using macOS open finder and go to Applications > Python3.7 folder (or whatever version of python you're using) > double click on "Install Certificates.command" file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.