Ubuntu 18.04 LTS – Python pip install fails due to outdated certificates

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

pip cannot download packages because TLS verification fails against package indexes.

Environment & Reproduction

Seen on older images with stale CA bundles or MITM proxy trust gaps.

Root Cause Analysis

Python tooling cannot validate remote certificates with current trust anchors.

Quick Triage

Test HTTPS connectivity and compare certificate chain trust from system and Python.

Step-by-Step Diagnosis

Inspect CA packages, pip configuration, and proxy certificate injection.

Solution – Primary Fix

Update CA certificates, pip tooling, and trusted proxy roots where required.

Solution – Alternative Approaches

Use internal package mirror with managed trust chain for controlled environments.

Verification & Acceptance Criteria

pip install completes over HTTPS without certificate verify failed errors.

Rollback Plan

Revert proxy trust additions if they conflict with enterprise trust policies.

Prevention & Hardening

Keep trust stores current and monitor certificate expiry across internal endpoints.

Related Errors & Cross-Refs

SSL CERTIFICATE_VERIFY_FAILED and unable to get local issuer certificate.

Related tutorial: View the step-by-step tutorial for Ubuntu 18.04 LTS.

View all Ubuntu 18.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

pip TLS troubleshooting, Python cert handling, and Ubuntu CA maintenance.