Conda update fails with SSL error CERTIFICATE_VERIFY_FAILED

Question

I have a problem with conda update. Specifically, I tried doing

conda update <package>

, and I got the following error:

Could not connect to https://repo.continuum.io/pkgs/free/osx-64/decorator-4.0.2-py27_0.tar.   
bz2 Error: Connection error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed 
(_ssl.c:590): https://repo.continuum.io/pkgs/free/osx-64/decorator-4.0.2-py27_0.tar.bz2

The full output of the command was the following:

conda update bokeh Fetching package metadata: SSL verification error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590) .SSL verification error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590) .SSL verification error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590) .SSL verification error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590) . Solving package specifications: . Package plan for installation in environment //anaconda:

The following packages will be downloaded:

    package                    |            build
    ---------------------------|-----------------
    decorator-4.0.2            |           py27_0          11 KB
    ipython_genutils-0.1.0     |           py27_0          32 KB
    path.py-8.1.1              |           py27_0          45 KB
    pexpect-3.3                |           py27_0          60 KB
    pickleshare-0.5            |           py27_0           8 KB
    simplegeneric-0.8.1        |           py27_0           6 KB
    traitlets-4.0.0            |           py27_0          88 KB
    ipython-4.0.0              |           py27_0         916 KB
    jinja2-2.8                 |           py27_0         263 KB
    tornado-4.2.1              |           py27_0         515 KB
    bokeh-0.9.3                |       np19py27_0        14.3 MB
    ------------------------------------------------------------
                                           Total:        16.2 MB

The following NEW packages will be INSTALLED:

    ipython_genutils: 0.1.0-py27_0    
    path.py:          8.1.1-py27_0    
    pexpect:          3.3-py27_0      
    pickleshare:      0.5-py27_0      
    simplegeneric:    0.8.1-py27_0    
    traitlets:        4.0.0-py27_0    

The following packages will be UPDATED:

    bokeh:            0.9.0-np19py27_0 --> 0.9.3-np19py27_0
    decorator:        3.4.2-py27_0     --> 4.0.2-py27_0    
    ipython:          3.2.0-py27_0     --> 4.0.0-py27_0    
    jinja2:           2.7.3-py27_1     --> 2.8-py27_0      
    tornado:          4.2-py27_0       --> 4.2.1-py27_0    

Proceed ([y]/n)? y

Fetching packages ... Could not connect to https://repo.continuum.io/pkgs/free/osx-64/decorator-4.0.2-py27_0.tar.bz2 Error: Connection error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590): https://repo.continuum.io/pkgs/free/osx-64/decorator-4.0.2-py27_0.tar.bz2

dendisuhubdy:finalproject dendisuhubdy$ brew link --force openssl Linking /usr/local/Cellar/openssl/1.0.2d_1... 1548 symlinks created dendisuhubdy:finalproject dendisuhubdy$ conda update bokeh Fetching package metadata: SSL verification error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590) .SSL verification error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590) .SSL verification error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590) .SSL verification error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590) . Solving package specifications: . Package plan for installation in environment //anaconda:

The following packages will be downloaded:

    package                    |            build
    ---------------------------|-----------------
    decorator-4.0.2            |           py27_0          11 KB
    ipython_genutils-0.1.0     |           py27_0          32 KB
    path.py-8.1.1              |           py27_0          45 KB
    pexpect-3.3                |           py27_0          60 KB
    pickleshare-0.5            |           py27_0           8 KB
    simplegeneric-0.8.1        |           py27_0           6 KB
    traitlets-4.0.0            |           py27_0          88 KB
    ipython-4.0.0              |           py27_0         916 KB
    jinja2-2.8                 |           py27_0         263 KB
    tornado-4.2.1              |           py27_0         515 KB
    bokeh-0.9.3                |       np19py27_0        14.3 MB
    ------------------------------------------------------------
                                           Total:        16.2 MB

The following NEW packages will be INSTALLED:

    ipython_genutils: 0.1.0-py27_0    
    path.py:          8.1.1-py27_0    
    pexpect:          3.3-py27_0      
    pickleshare:      0.5-py27_0      
    simplegeneric:    0.8.1-py27_0    
    traitlets:        4.0.0-py27_0    

The following packages will be UPDATED:

    bokeh:            0.9.0-np19py27_0 --> 0.9.3-np19py27_0
    decorator:        3.4.2-py27_0     --> 4.0.2-py27_0    
    ipython:          3.2.0-py27_0     --> 4.0.0-py27_0    
    jinja2:           2.7.3-py27_1     --> 2.8-py27_0      
    tornado:          4.2-py27_0       --> 4.2.1-py27_0    

Proceed ([y]/n)? y

Fetching packages ... Could not connect to https://repo.continuum.io/pkgs/free/osx-64/decorator-4.0.2-py27_0.tar.bz2 Error: Connection error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590): https://repo.continuum.io/pkgs/free/osx-64/decorator-4.0.2-py27_0.tar.bz2

Please advise: what should I do to overcome this error?

check my answer , after extensive search I have solved that error , its a simple one and it will definitely help you with 64 bit version of anaconda on windows 10 — dev, Jun 20 '19 at 14:31

score 141 · Answer 1 · edited Oct 04 '17 at 13:01

141

Conda needs to know where to find you SSL certificate store.

conda config --set ssl_verify <pathToYourFile>.crt

No need to disable SSL verification.

This command add a line to your $HOME/.condarc file or %USERPROFILE%\.condarc file on Windows that looks like:

ssl_verify: <pathToYourFile>.crt

If you leave your organization's network, you can just comment out that line in .condarc with a # and uncomment when you return.

If it still doesn't work, make sure that you are using the latest version of curl, checking both the conda-forge and anaconda channels.

edited Oct 04 '17 at 13:01

Rich Signell

14,842
4
49
77

answered Mar 04 '16 at 19:49

user6020015

1,469
1
9
2

9

This is the real answer. I encountered this because my organization intercepts traffic with an internal cert. Once I download their certificate and pointed conda to it, no more errors. – Steven Magana-Zook Jun 10 '16 at 17:06
61

where to find my certificate? – Ken T Dec 22 '16 at 02:09
3

Yes, but then this will only work while you are within your organization's network. If you are using a notebook and you exit the network, it will not work. What can be done that supports adding this certificate _in addition to_ the ones already used by conda? – payala Jul 04 '17 at 15:26
21

WHERE can we find the path to the certificate? – nonremovable Feb 13 '19 at 14:19
1

To integrate with Linux CA management (at least in CentOS), pointing to the system CA bundle by adding the line `ssl_verify: /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt` in `.condarc` works. (don't forget to add your ca in `/etc/pki/ca-trust/source/anchors/` then run the `update-ca-trust` command to update the bundle). This should be the answer for @ken-t and @nonremovable – KWA Apr 16 '19 at 09:43
1

This works perfectly when you are behind corporate proxy. Just use your proxy's CA certificate. Even in PEM format also fine. – bms Jan 22 '20 at 07:06
For Debian based distros, the cert bundle is located at `/etc/ssl/certs/ca-certificates.crt`. To add your own CA(s), copy the cert(s) to `/usr/local/share/ca-certificates/.crt` then run `update-ca-certificates`. – pavon Mar 08 '21 at 23:28
5

If your organization doesn't provide instructions on how to obtain the proxy CA cert, you can usually get a copy by clicking on the padlock icon in your browser when visiting any https site, then click around to view certificate, and download in PEM format. You want the root-most certificate you can download.The details will vary by browser and version. – pavon Mar 08 '21 at 23:33
1

This is the correct answer. On Windows 10, if you can't find in `mmc` and Certificates snap, just go a website on any browser. Click the lock sign and export your company's certificate, put that in a folder `C:\Users\myusername\.certificates`, and then add to configuration just like @user6020015 showed above. It worked for me. – mmustafaicer Mar 01 '23 at 19:32

score 138 · Accepted Answer · edited Jul 15 '21 at 16:08

138

Please note that the following solution is not secure. See: https://conda.io/projects/conda/en/latest/user-guide/configuration/disable-ssl-verification.html

according to @jreback here https://github.com/conda/conda/issues/1166

conda config --set ssl_verify false

will turn off this feature, e.g. here

edited Jul 15 '21 at 16:08

Ben James

121,135
26
193
155

answered Nov 13 '15 at 18:33

Dendi Suhubdy

2,877
3
19
20

Mine is up to date too. You can also add this in your .condarc like so: `ssl_verify: false` – Noel Evans Jun 30 '17 at 15:23
4

I also continue to see this error after updating, specifying certificate paths, and trying many other solutions. In the end the only way to keep getting work done was to disable it, which I *really* don't like to do. – ely May 02 '18 at 17:53
2

Not sure why one would risk turning of SSL verification. It's there for security, your organization would not be happy if they found out. Ultimately, you could suffer consequences from man in the middle attacks or from your organization. Try the solution below. – spacedustpi Aug 03 '18 at 00:07
1

@spacedustpi I turn this off during testing of air-gapped repository configuration. It is a (the only?) valid reason for doing so. Doing so in production would be a bad idea. – Jefferey Cave Feb 26 '19 at 13:15
7

This is not a solution. This is exposing yourself to security vulnerabilities. Please update the answer to clearly state that this has risks associated and should only be used for debugging the problem. – UmaN Mar 01 '19 at 08:47
This is not recommended. See [this](https://conda.io/projects/conda/en/latest/user-guide/configuration/disable-ssl-verification.html#) – Divyanshu Srivastava May 10 '19 at 11:06
All: I believe the wiki-like "edit" feature on SO is for precisely this reason. Please correct me if it's somehow out of bounds to edit an answer in this way. (My edit is pending peer review.) – Philip Jan 22 '20 at 16:16

score 28 · Answer 3 · edited Mar 23 '23 at 21:33

I faced the same problem on Mac OS X and with Miniconda. After trying many of the proposed solutions for hours I found that I needed to correctly set Conda's environment – specifically requests' environment variable – to use the Root certificate that my company provided rather than the generic ones that Conda provides.

I solved it using the information from the Conda docs:

Open Chrome, go to any website, click on the lock icon on the left of the URL. Click on «Certificate» on the dropdown. In the next window you see a stack of certificates. The uppermost (aka top line in window) is the root certificate (e.g. Zscaler Root CA in my case, yours will very likely be a different one).

Open Mac OS keychain, click on «Certificates» and choose among the many certificates the root certificate that you just identified. Export this to any folder of your choosing.

Convert this certificate with openssl: openssl x509 -inform der -in /path/to/your/certificate.cer -out /path/to/converted/certificate.pem

For a quick check set your shell to acknowledge the certificate: export REQUESTS_CA_BUNDLE=/path/to/converted/certificate.pem

To set this permanently open your shell profile (.bshrs or e.g. .zshrc) and add this line: export REQUESTS_CA_BUNDLE=/path/to/converted/certificate.pem. Now exit your terminal/shell and reopen. Check again.

You should be set and Conda should work fine.

In newer versions of Keychain Access.app you can also change the export filetype to .pem and skip step 3.

I was certain this was going to take me a day to solve, but happening upon this answer, I solved it in 15 minutes. — Henrietta Martingale, Dec 02 '21 at 15:39
Seems familiar https://docs.conda.io/projects/conda/en/latest/user-guide/configuration/non-standard-certs.html — reergymerej, Feb 03 '23 at 12:49

score 25 · Answer 4 · answered Dec 07 '15 at 00:54

25

This seemed to do the trick for me:

conda remove certifi
conda install certifi

Then you can do whatever you were trying to do before, e.g.

conda update --all

answered Dec 07 '15 at 00:54

Mike T

41,085
18
152
203

1

I tried conda config --set ssl_verify False, did not work. These 3 commands solved my problem. – Frank May 20 '20 at 16:11

score 15 · Answer 5 · edited Jun 01 '18 at 15:12

15

For those of us on corporate networks using web filters that implement trusted man in the middle SSL solutions, it is necessary to add the web-filter certificate to the certifi cacert.pem.

A guide to doing this is here.

Main steps are:

connect to https site with browser
view and save root certificate
convert cert to .pem
copy and paste onto end of existing cacert.pem
save
SSL happiness

edited Jun 01 '18 at 15:12

Georgy

12,464
7
65
73

answered May 23 '18 at 10:33

fistynuts

306
2
8

3

This is it! Adding your certificate to ...\Anaconda3\Lib\site-packages\certifi\cacert.pem made it work. – image357 Oct 15 '20 at 06:33
2

How to convert cert to .pem? – FMFF Dec 08 '20 at 06:20
@FMFF ```openssl x509 -inform der -in your_cer_file.cer -out new_pem_file.pem``` – Paulloed Oct 24 '22 at 18:12

score 4 · Answer 6 · answered Apr 21 '19 at 19:53

For everyone struggling with this issue, you simply need to upgrade your openssl installation. I'm running windows 10, installed the latest anaconda 64-bit and am getting this error when I try to install/upgrade anything with 'conda' or 'pip'. If I uninstall the 64-bit anaconda and install the 32-bit, it works fine. I had a 64-bit version of openssl for windows installed, version 1.1.0 something. I uninstalled that and installed the latest I could find from here: https://slproweb.com/products/Win32OpenSSL.html -- there is a 64-bit version of 1.1.1 on there that worked. Now I can install packages via pip and conda successfully. Hope this helps.

score 3 · Answer 7 · answered Dec 07 '22 at 14:33

3

For me the problem was the proxy configuration. I had in my .condarc:

proxy_servers:
    http: http://our.proxy.org:80/
    https: https://our.proxy.org:80/

that did not work. Instead, the HTTPS proxy had to be specified with the http protocol (i.e. without the s). So,

proxy_servers:
    http: http://our.proxy.org:80/
    https: http://our.proxy.org:80/

answered Dec 07 '22 at 14:33

vinjana

61
2

Excellent. Elegant, clean solution. Took a while, but I found your solution and it worked for me. – sAguinaga Jul 07 '23 at 22:01

score 2 · Answer 8 · answered Apr 23 '19 at 15:51

2

That SSL error is misleading. I am using Anaconda 3, conda version 4.6.11, have the most current version of openssl on a Windows 10 instance. I got the issue resolved by changing the security settings on the Anaconda3 folder to Full Control. Don't think this helped, but I also have modified the ..\Anaconda3\Lib\site-packages\certifi\cacert.pem file to include the company's SSL cert.

Hope this info helps you.

answered Apr 23 '19 at 15:51

kc2u11

21
1

Actually, adding the company certificate to \Anaconda3\Lib\site-packages\certifi\cacert.pem made it work! – image357 Oct 15 '20 at 06:18
How does your cacert.pem file look like after including the company's SSL cert? Can you share pls? – FMFF Dec 08 '20 at 06:20

score 1 · Answer 9 · answered Sep 10 '21 at 21:27

The following worked for me: (MAC)

Use homebrew to install openssl1.1 certs

brew install openssl@1.1

Add the installed certs to an env variable with:

export REQUESTS_CA_BUNDLE='/usr/local/etc/openssl@1.1/cert.pem'

To persist your env variable to anaconda, first activate the relevant environment, then execute:

conda env config vars set export REQUESTS_CA_BUNDLE='/usr/local/etc/openssl@1.1/cert.pem'

score 1 · Answer 10 · answered Apr 18 '22 at 21:30

New poster unable to comment yet - but here's an additional option and clarification if you have a non-default trusted SSL certificate, such as when using corporate internet monitoring software like ZScaler.

Assuming you have a new trusted.pem file, you may need to append this trusted.pem to the certificate at the path python -m certifi, AND, set this concatenated .pem file to the REQUESTS_CA_BUNDLE variable.

It may not work if you only set REQUESTS_CA_BUNDLE to trusted.pem.

Tested on Windows 10. Related variables are AWS_CA_BUNDLE, SSL_CERT_FILE, and CURL_CA_BUNDLE, though these need to be set to trusted.pem only on your local, not to the concatenated version.

For whatever reason, inside a Dockerfile, these ENV variables need to be the concatenated .pem file (after relevant COPY commands of course)

score 1 · Answer 11 · answered Jan 17 '23 at 22:16

I seem to have discovered another scenario which is not covered by all the possible causes listed here. Inexplicably, even turning of ssl_verify had no effect and kept producing the same SSLError. set SSL_NO_VERIFY=1 also had no effect.

It turns out that this is due the REQUESTS_CA_BUNDLE variable that we have set to the standard corporate certificate bundle. It includes zscaler proxy certificates etc. and other internal CAs needed for everyday development. But apparently our internal Anaconda repository uses its own certificate that is not covered by this bundle.
I guess the only surprising part here was the precedence. I was incorrectly expecting at least the conda specific environment variable (if not the .condarc setting) to override any other implicit ones like the requests library variable.

So, a quick way to debug this in my case was to temporarily remove the requests variable while I request for the anaconda certificate to be added to the corporate bundle:

set REQUESTS_CA_BUNDLE=

Of course, a better fix is to configure the individual certificate explicitly as shown in other answers:

conda config --set ssl_verify "C:\ProgramData\condaRepoCert.pem"

True, but I had been referring to a Windows environment in my answer. — Amit Naidu, Jan 17 '23 at 23:22

score 0 · Answer 12 · answered Aug 27 '20 at 18:11

After 2 hrs of net surfing Finally For me the problem was fixed by creating a folder pip, with a file: pip.ini in C:\Users<username>\AppData\Roaming\ e.g:

C:\Users\<username>\AppData\Roaming\pip\pip.ini

Inside it I wrote:

[global]
trusted-host = pypi.python.org
pypi.org
files.pythonhosted.org

I restarted python, and then pip permanently trusted these sites, and used them to download packages from.

If you can't find the AppData Folder on windows, write %appdata% in file explorer and it should appear.

Source : pip install fails with "connection error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:598)"

score 0 · Answer 13 · answered Aug 23 '22 at 07:45

0

on windows, set the SSL_NO_VERIF environment variable to 1. set SSL_NO_VERIFY=1

refer to https://conda.io/projects/conda/en/latest/user-guide/configuration/disable-ssl-verification.html

answered Aug 23 '22 at 07:45

liang

1,571
1
20
22

score 0 · Answer 14 · edited Sep 16 '22 at 00:40

In order that anaconda3 will work with RHEL\Centos based:

Add your certificates to: /etc/pki/ca-trust/source/anchors/
Run:
```
update-ca-trust
```

Export:

export CURL_CA_BUNDLE=/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt 
export REQUEST_CA_BUNDLE=/etc/pki/ca-trust/extracted/openssl/cabundle.trust.crt  
export SSL_CERT_FILE=/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt`

Run:
```
conda info -s
```

You should see those envs configured in conda.

score 0 · Answer 15 · answered Sep 29 '22 at 15:43

0

For me, it's actually because I am using VPN. So I'm just turning VPN off, this problem solved. (confusing me quiet a while)

Hope this answer helpful.

answered Sep 29 '22 at 15:43

ailing renn

1

this is a workaround for a specific case, not really an answer to the question. Do not reply like that, just post a comment. – Valery S. Oct 05 '22 at 12:52

score 0 · Answer 16 · edited May 11 '23 at 14:47

0

This is due to .dll error

Go to the location where you've install anaconda anaconda3>Library>bin. Search and copy these two .dll files

libcrypto-1_1-x64.dll
libssl-1_1-x64.dll

Paste them to this folder: anaconda3>DLLs

Then restart your pc.

Credit to: https://github.com/conda/conda/issues/11982

edited May 11 '23 at 14:47

Yaakov Bressler

9,056
2
45
69

answered Nov 08 '22 at 23:27

Durodola

17
2

score 0 · Answer 17 · answered May 11 '23 at 13:02

0

On linux, you need to do this:

cd miniconda3
mkdir DLLs
cp lib/libcrypto* DLLs
cp lib/libssl* DLLs

you should be all set

answered May 11 '23 at 13:02

snamburi3

23
4

score 0 · Answer 18 · answered Jul 05 '23 at 18:17

Same issue I faced below pip configurations fixed my error

pip config --user set global.index https://your-domain/repository/public-lib-python-pypi/pypi
pip config --user set global.index-url https://your-domain/repository/public-lib-python-pypi/simple
pip config --user set global.trusted-host your-domain

Conda update fails with SSL error CERTIFICATE_VERIFY_FAILED

18 Answers18

Linked

Related