pip fails with SSLError on MacOS because of outdated certificate - how to recover?

Question

When searching or installing packages with pip on MacOS (10.11.6), I am getting an SSL error similar to the one reproduced below.

The problem occurs for both python2 and python3. I acquired the versions (2.7.14 and 3.6.5) via www.python.org as Frameworks. The version of pip was 9.0.1. The problem is new (April 2018) and seems related to an update of OSX.

How to recover from this problem?

$ pip2 search numpy

Exception:
Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/pip/basecommand.py", line 215, in main
    status = self.run(options, args)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/pip/commands/search.py", line 45, in run
    pypi_hits = self.search(query, options)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/pip/commands/search.py", line 62, in search
    hits = pypi.search({'name': query, 'summary': query}, 'or')
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/xmlrpclib.py", line 1243, in __call__
    return self.__send(self.__name, args)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/xmlrpclib.py", line 1602, in __request
    verbose=self.__verbose
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/pip/download.py", line 775, in request
    headers=headers, stream=True)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/pip/_vendor/requests/sessions.py", line 522, in post
    return self.request('POST', url, data=data, json=json, **kwargs)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/pip/download.py", line 386, in request
    return super(PipSession, self).request(method, url, *args, **kwargs)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/pip/_vendor/requests/sessions.py", line 475, in request
    resp = self.send(prep, **send_kwargs)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/pip/_vendor/requests/sessions.py", line 596, in send
    r = adapter.send(request, **kwargs)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/pip/_vendor/cachecontrol/adapter.py", line 47, in send
    resp = super(CacheControlAdapter, self).send(request, **kw)
  File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/pip/_vendor/requests/adapters.py", line 497, in send
    raise SSLError(e, request=request)
SSLError: [SSL: TLSV1_ALERT_PROTOCOL_VERSION] tlsv1 alert protocol version (_ssl.c:661)

Possible duplicate of [Not able to install python packages \[SSL: TLSV1\_ALERT\_PROTOCOL\_VERSION\]](https://stackoverflow.com/questions/49768770/not-able-to-install-python-packages-ssl-tlsv1-alert-protocol-version) — Anupam, Apr 24 '18 at 10:17
The error message is not exactly the same, but the problem definitely is a duplicate. Searching for a solution for this problem did not guide me to that useful SO thread (though my favourite search engine still needs to reorder priorities for this new topic). — normanius, Apr 24 '18 at 10:34
Yes, this change in TLS support is generating a lot of posts on SO and elsewhere. You are right that relevant posts are not easy to find sometimes. It would have been great to be able to point users to 'possible cause' posts when they search for related errors, especially for big changes like these. — Anupam, Apr 24 '18 at 10:37

normanius · Accepted Answer · 2018-04-24T10:37:12.147

6

There are two ways to recover from this problem.

Solution 1. As can be read here, Python.org sites stopped the support for older TLS versions, which breaks pip < 9.0.3. A new release of pip was provided, but because one cannot simply update via the broken pip, one has to bootstrap the installation. This worked for me:

# For python2
curl https://bootstrap.pypa.io/get-pip.py | python2
# For python3 (haven't tested this myself)
curl https://bootstrap.pypa.io/get-pip.py | python3

Credits for these commands go back to this SO post.

Solution 2. For Python 3.6 frameworks, a script Install Certificates.command is deployed and installed under /Applications/Python 3.6/. Executing it resolved the problem, but only for pip3.

edited Apr 24 '18 at 10:37

answered Apr 24 '18 at 10:08

normanius

8,629
7
53
83

2

Actually, OSX didnt really break TLS for `pip` < 9.0.3 but Python.org sites stopped supporting older TLS (v1.0 and v1.1) causing `pip` to fail if using older TLS. See this [detailed answer](https://stackoverflow.com/a/49748494/1526703) (also linked from the SO post you mentioned) – Anupam Apr 24 '18 at 10:22
Got it. Updated my answer accordingly. Thanks for the information. – normanius Apr 24 '18 at 10:37
after several days i found this post thanks - have troubleshooted all about ptoxy and certificates, but it was due to failing PIP versions. I installed latest version of python, and downloaded https://pypi.org/project/pip/9.0.3/#files and did manual downgrade "pip install pip-9.0.3.tar.gz" now it works – user625079 Sep 13 '21 at 14:44

score 1 · Answer 2 · answered Feb 06 '20 at 20:40

1

You just need to reinstall Python

brew reinstall python

answered Feb 06 '20 at 20:40

Saad Mirza

1,154
14
22

pip fails with SSLError on MacOS because of outdated certificate - how to recover?

2 Answers2

Linked