Ubuntu 20.04 LTS Python pip SSL Certificate Verify Failed

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

pip cannot install packages because TLS certificate validation fails.

Environment & Reproduction

Ubuntu 20.04 LTS in environments with custom CA chains or TLS inspection.

Root Cause Analysis

Python trust store lacks required CA certificates for package index endpoints.

Quick Triage

Check system time and CA bundle status before changing pip behavior.

Step-by-Step Diagnosis

Inspect certificate paths, pip config, and OpenSSL trust configuration.

Solution – Primary Fix

Install proper CA certificates and point pip to trusted cert bundle.

Solution – Alternative Approaches

Use internal package mirror with enterprise-trusted certificates.

Verification & Acceptance Criteria

pip install runs without SSL errors against required package indexes.

Rollback Plan

Revert pip and CA config if trust chain changes break other tooling.

Prevention & Hardening

Centralize certificate trust management and avoid insecure pip flags.

Related Errors & Cross-Refs

Linked to NTP drift, proxy interception, and expired root CA bundles.

Related tutorial: View the step-by-step tutorial for Ubuntu 20.04 LTS.

View all Ubuntu 20.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

See pip TLS docs, certifi notes, and Ubuntu ca-certificates guidance.