Mac OSX python ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:749)

Question

Many operations in Python require accessing things via https. This includes pip install command, or just using http.client.HTTPSConnection, or any modules or applications that use these things internally.

If python was installed from the official python pkg installer, downloaded from https://python.org, then it uses an internal version of openssl, and contains no root certificates. Anything that uses an SSL connection results in this error:

ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:749)

How can I install root certs to make the above error go away?

You should reinstall Xcode command line tools that contains Python. https://stackoverflow.com/a/68247505/4067700 — Victor Kushnerov, Jul 05 '21 at 08:35

score 241 · Answer 1 · edited Apr 10 '21 at 15:31

241

When you run the python installer, they display this information to you. It is also documented in /Applications/Python 3.6/ReadMe.rtf, but it's very easily overlooked.

Just browse to Applications/Python 3.6 and double-click Install Certificates.command

There is an issue in the Python bug tracker about this. http://bugs.python.org/issue29480

Update: This issue is marked as resolved in the bug tracker with this text being part of the latest comment:

... For 3.7.0b2, I have tried to make things more obvious in two ways. One, the installer package will now attempt to open a Finder window for the /Application/Python 3.7 folder that contains the "Install Certificates.command". Two, rather than just a generic "installation complete" message at the end of the install, there is now a tailored message that urges the user to click on the "Install Certificates.command" icon. ...

edited Apr 10 '21 at 15:31

0 _

10,524
11
77
109

answered Feb 07 '17 at 19:17

Edward Ned Harvey

6,525
5
36
45

2

Is there a solution, if one doesn't have root access? Thanks. – tommy.carstensen May 18 '17 at 22:08
4

I ran the Install Certificates.command file but the error persists (in Py36) if I use an https URL in my code (to read content). If I use the same URL string minus the "s" (e.g., http), my code works. Unfortunately, I need https for some URLs. Any suggestion for this? (I also ran "pip3 install --upgrade certifi" because I need both Py27 and Py36 running) – ultrageek Feb 13 '18 at 00:57
For those without root; check out this answer: https://bugs.python.org/issue29095 – tommy.carstensen Feb 15 '18 at 19:04
Thanks a lot, spend hours to find a solution till reach this answer. Awesome. – mrblue May 01 '18 at 08:56
It's answers like these that spoil programmers ;) – Anurag Priyadarshi Jul 02 '18 at 03:29
2

This does not work; all errors persist, just as @ultrageek mentions. Also, please list the actual command instead of the alias that is bundled with a specific version of Python. -1. – hpm Dec 02 '18 at 12:39
@AaronCruz, The problem described here is a version-specific bundling bug, hence the link to version-specific script to fix it, and link to bug report that was closed in python 3.7. First try updating to latest python, or running the Install Certificates script. If that doesn't work, you're having a different problem, so next, ensure the server actually has the right certs - don't test cert validity with your browser, because browsers build caches of cert chains. Test with a tool like https://www.ssllabs.com/ssltest/ or similar. If none of these help you, I don't know what you need. – Edward Ned Harvey Dec 03 '18 at 20:41
Running `/Applications/Python\ 3.6/Install\ Certificates.command` in Terminal should work too. – David Douglas Feb 04 '19 at 15:10
1

Any idea what to do if I installed python using anaconda? I don't see Install Certificates.command anywhere – ucb Mar 27 '19 at 22:40
20

I don't have Python in my Applications folder – flppv Apr 09 '19 at 09:44
Could you mark this as the accepted answer? The problem is resolved in a way, at least closed in the python bug tracker. – creyD Jun 20 '19 at 16:10
@useranon did you ever figure it out? I also installed with Anaconda and can't seem to find the file everyone's talking about – Rohan Shah Sep 27 '20 at 13:44
@flppv you can run `which python3` to see where is this folder located. Then just `cd` in and use `open .` if you want to open the folder in your Finder. – gma992 Jun 30 '21 at 10:15
4

@gma992 I installed python through homebrew and pyenv. I don't see an Install Certificaters command in the directory where my python version is stored. – Khalil Hijazi Aug 10 '21 at 16:43
Using venv with Python 3.9 and had to double-click on Install Certificates.command – Erick Audet Feb 20 '23 at 02:40

score 58 · Answer 2 · edited Aug 22 '19 at 17:31

58

I solved this problem using this command:

open /Applications/Python\ 3.7/Install\ Certificates.command

I have Python 3.7 in my machine.

Check this link - Fixing CERTIFICATE_VERIFY_FAILED error when trying requests-html out on Mac

edited Aug 22 '19 at 17:31

ejderuby

710
5
21

answered Aug 22 '19 at 17:07

hyung ook An

591
4
4

I have python3.9 and just changing the 7 for the 9 works, thank you! – Jesus Walker May 17 '22 at 01:48
thanks also works in python3.6, or just `python3.6 -m pip install -U certifi` works for me – Rainy Chan Jul 25 '23 at 07:39

score 54 · Answer 3 · answered Jan 27 '20 at 10:09

54

Cool way to solve this issue for all your python version and without checking your version on macOS

bash /Applications/Python*/Install\ Certificates.command

This command is equivalent to:

...
bash /Applications/Python\ 2.7/Install\ Certificates.command
bash /Applications/Python\ 3.6/Install\ Certificates.command
bash /Applications/Python\ 3.7/Install\ Certificates.command
...

It helped me hope it will help you as well

answered Jan 27 '20 at 10:09

Oded BD

2,788
27
30

% python3 get-pip.py --> WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:992)'))': /simple/pip/ Could not fetch URL https://pypi.org/simple/pip/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/pip/ (Caused by SSLError(SSLCertVerificationError(1, – Ashish Karpe Oct 25 '22 at 10:48
'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:992)'))) - skipping ERROR: Could not find a version that satisfies the requirement pip (from versions: none) – Ashish Karpe Oct 25 '22 at 10:48
bash /Applications/Python*/Install\ Certificates.command -- pip install --upgrade certifi /Library/Frameworks/Python.framework/Versions/3.11/bin/python3.11: No module named pip Traceback (most recent call last): File "", line 44, in File "", line 24, in main File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/subprocess.py", line 413, in check_call raise CalledProcessError(retcode, cmd) subprocess.CalledProcessError: Command ' – Ashish Karpe Oct 25 '22 at 10:49
['/Library/Frameworks/Python.framework/Versions/3.11/bin/python3.11', '-E', '-s', '-m', 'pip', 'install', '--upgrade', 'certifi']' returned non-zero exit status 1. – Ashish Karpe Oct 25 '22 at 10:49

score 38 · Answer 4 · answered Apr 10 '20 at 14:35

38

If pip does not fix the issue

pip3 install --upgrade certifi

Then try the following scripts if you can't find the "Install Certificates.command"

#!/usr/bin/env python3
# install_certifi.py
#
# sample script to install or update a set of default Root Certificates
# for the ssl module.  Uses the certificates provided by the certifi package:
#       https://pypi.python.org/pypi/certifi

import os
import os.path
import ssl
import stat
import subprocess
import sys

STAT_0o775 = ( stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR
             | stat.S_IRGRP | stat.S_IWGRP | stat.S_IXGRP
             | stat.S_IROTH |                stat.S_IXOTH )


def main():
    openssl_dir, openssl_cafile = os.path.split(
        ssl.get_default_verify_paths().openssl_cafile)

    # +++> if already done  <----
    #print(" -- pip install --upgrade certifi")
    #subprocess.check_call([sys.executable,
    #    "-E", "-s", "-m", "pip", "install", "--upgrade", "certifi"])

    import certifi
    # change working directory to the default SSL directory
    os.chdir(openssl_dir)
    relpath_to_certifi_cafile = os.path.relpath(certifi.where())
    print(" -- removing any existing file or link")
    try:
        os.remove(openssl_cafile)
    except FileNotFoundError:
        pass
    print(" -- creating symlink to certifi certificate bundle")
    os.symlink(relpath_to_certifi_cafile, openssl_cafile)
    print(" -- setting permissions")
    os.chmod(openssl_cafile, STAT_0o775)
    print(" -- update complete")

if __name__ == '__main__':
    main()

answered Apr 10 '20 at 14:35

Andy Wang

489
5
4

2

Thanks. Worked for me. Probably the only solution that will work in many cases. – Mercado May 11 '20 at 14:11
Works on ubuntu too! Thank god – Rotartsi Jun 18 '20 at 01:04
Even though I found `Install Certificates.command`, I had to run this script to solve the problem. I had b0rked my environment pretty good with an overzealous `find ... -delete` which may have contributed. – Joe Germuska Aug 19 '20 at 21:56
I've had this problem intermittently for years, and this script solved it. You are a hero amongst developers. – Tom Swirly Oct 29 '20 at 18:01
Spent a few hours on this and tried many other SO solutions... this is the only one that worked. I'm on Python 3.8 installed with Homebrew. – Justin Jun 10 '21 at 21:13
After many tries with different solutions, this finally fixed it. Thanks. – gma992 Jun 30 '21 at 10:37
Not all hereos wear capes and you just saved my life buddy ! Thanks (^_^) – madprogramer Jul 09 '21 at 07:55
I will be forever grateful to you. – martin Jul 16 '21 at 14:54
Worked in Ubuntu! After so many tries, this is the only solution that worked for me! You're a God! – Ronnieeeone Jul 19 '22 at 13:26
works in pyenv! thx – Cheng Jie Hung Aug 10 '22 at 07:17
you're the man (y) I have multiple python installations (from package and from homebrew) and i am totally lost. This script fixed the issue ! Run it with `python3 script_name.py` command – samasoulé Feb 17 '23 at 12:06
This was the only answer working for me on `MacOS M1 Sonoma` – GarryOne Aug 01 '23 at 18:51

score 9 · Answer 5 · answered Mar 01 '22 at 15:50

9

If you're using MacOS go to Applications >> python3.8 >> and double-click Install Certificates.command. This worked for me.

answered Mar 01 '22 at 15:50

Ahmed J.

484
6
11

score 7 · Answer 6 · answered Oct 21 '19 at 21:13

In my case none of the solutions worked with the system installed python3 in macOS Catalina, neither did it work with python3 installed via brew.

If someone has a situation like this and wants a quick solution,
Download and install python3 again, using https://www.python.org/downloads/

At the end of the installation, the installer would show you a note, asking to run the Install Certificates.command file.
(With the other installations, this file was not present, and neither was the solution with the file's source code working)

Restart the terminal, and you can type where python3, to see /Library/Frameworks/Python.framework/Versions/3.8/bin/python3. Using this binary, the problem should not occur.

Note: It might be possible to make the system-installed python3 work, but in my case; it proved to be extremely hard, so I choose this way.

This led me to the correct solution on Catalina when trying to get my bitbar python3 plugins working. I saw I had a couple python3 installations with `which python3` and changing the script shebang to `#!/usr/local/bin/python3` fixed the SSL errors. Thanks! — Michael, Dec 10 '19 at 16:35

score 3 · Answer 7 · edited Jun 22 '19 at 19:22

3

I faced the same problem, when I tried to run Python with Keras data loading. The error for me was:

Exception: URL fetch failure on AWS_URL: None -- [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:833)

I fixed my problem by upgrading the certificate as:

pip install --upgrade certifi

edited Jun 22 '19 at 19:22

creyD

1,972
3
26
55

answered Jun 20 '19 at 14:35

Ratha Pech

31
1

Hi! It is `pip install --upgrade certificate` isn't it? I made an edit to your post, but wasn't sure if this is a spelling mistake or a module I don't know. – creyD Jun 20 '19 at 14:44
Or is it this [module](https://pypi.org/project/certifi/)? Then please feel free to correct it! – creyD Jun 20 '19 at 16:13
3

It’s not a spelling mistake, but just a module name. – Ratha Pech Jun 22 '19 at 13:26

score 2 · Answer 8 · answered Feb 04 '21 at 11:54

2

Confirm you are not in a virtualenv. I tried the above without success, only to realise my installations were failing because I was on a virtualenv

answered Feb 04 '21 at 11:54

StackEdd

624
1
10
23

How to make it work in virtual environments? – Valentino Pereira Feb 07 '23 at 08:39
@ValentinoPereira check the python version in the virtual env, and try update it using "/Applications/Python {version}/Install Certificates.command" – StackEdd Mar 03 '23 at 07:25

score 1 · Answer 9 · answered Apr 27 '17 at 13:19

1

A cheap way around this is just using python3.5 if you still have it installed.

Pushing to PyPI:

python3.5 setup.py register -r pypitest

python3.5 setup.py sdist upload -r pypitest

pipping seems to work fine with 3.6 out of the box..

answered Apr 27 '17 at 13:19

jarekwg

375
3
8

score 0 · Answer 10 · answered Jan 02 '21 at 11:14

0

For me, it was a misspecification of the request. I'd made a https call instead of a http call. Changing to http solved it.

answered Jan 02 '21 at 11:14

ulle

11

Boris Treukhov · Answer 11 · 2021-04-10T21:45:46.677

0

Ensure that you do not have SSL_CERT_FILE environment variable set. I had the same problem, it took a while before I figured out some application was setting this variable as an empty string inside my bash profile.

edited Apr 10 '21 at 21:45

answered Apr 10 '21 at 17:09

Boris Treukhov

17,493
9
70
91

score 0 · Answer 12 · answered Jul 14 '21 at 07:48

I had the same issue with macOS Big Sur. Here is what I did to solve the issue.

IDE - Pycharm

Python Version Downloaded - 3.9.6

Download the latest python version and remove the earlier version
While installation, at the end (Summary Section), there is a small note to install an SSL Certificate. Read that Summary section carefully.
Double click the SSL Certificate path provided in the summary
It will take you to the respective folder where there should be one file named - "Install Certificate Command"
Double click on that file, it should open the terminal and will run the code automatically. Wait till you receive the message as "[Completed Successfully]".
Once done close and restart terminal/IDE and this should resolve your issue.

Note: if you have anaconda and python both installed on your system then check whether you are using the correct python version in the IDE which the latest version downloaded and not from Anaconda.

Enjoy.

score 0 · Answer 13 · answered Dec 28 '22 at 13:04

I needed to add my corporate CA certs into the python CA cert file due to corporate SSL gateways.

The location of the CA cert file is found by

import ssl
print(ssl.get_default_verify_paths().openssl_cafile)

The cert to be added was in keychain. After exporting it, it needed converting into PEM format so it could be cut & pasted into the cacert file -

openssl x509 -inform der -in cert.cer -out cert.pem

score 0 · Answer 14 · answered Feb 19 '23 at 16:42

0

I did this and it worked on my Mac: Macintoch HD>Applications>Python file>Install Certificates.command (double click on it)

answered Feb 19 '23 at 16:42

mariaFinance

11
1

score -1 · Answer 15 · answered Sep 13 '21 at 09:40

-1

Just REINSTALL your Python on your Mac

answered Sep 13 '21 at 09:40

eastonsuo

935
9
11

score -1 · Answer 16 · answered Oct 17 '21 at 15:53

-1

sometimes if you're using conda or poetry you may be in a virtual environment shell. you can check with:

which python

for me the solution was as simple as cmd+t to open a new shell.

answered Oct 17 '21 at 15:53

Sonic Soul

23,855
37
130
196

score -3 · Answer 17 · answered Jun 11 '19 at 18:12

-3

If you're using macOS open finder and go to Applications > Python3.7 folder (or whatever version of python you're using) > double click on "Install Certificates.command" file.

answered Jun 11 '19 at 18:12

pt_arun

1

Mac OSX python ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:749)

17 Answers17

Linked