Python pip SSL Certificate Verify Failed

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

pip install fails with certificate verification errors, blocking Python dependency deployment.

Environment & Reproduction

Ubuntu 18.04 systems with outdated CA bundle, proxy TLS interception, or wrong system time.

Root Cause Analysis

TLS chain cannot be validated by current trust store or local SSL configuration.

Quick Triage

Test TLS handshake to package index and verify CA package and time settings.

Step-by-Step Diagnosis

Inspect certificate chain, proxy behavior, and Python SSL module trust path.

Solution – Primary Fix

Update ca-certificates, correct time drift, and configure trusted proxy certificates.

Solution – Alternative Approaches

Use internal package index with managed certificates for enterprise environments.

Verification & Acceptance Criteria

pip installs dependencies over HTTPS without certificate warnings or failures.

Rollback Plan

Revert CA changes if trust path modifications break other TLS-dependent applications.

Prevention & Hardening

Automate CA updates and monitor certificate expiry for internal and external endpoints.

Related Errors & Cross-Refs

CERTIFICATE_VERIFY_FAILED, TLSV1_ALERT_UNKNOWN_CA, and handshake timeout issues.

Related tutorial: View the step-by-step tutorial for Ubuntu 18.04 LTS.

View all Ubuntu 18.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Python packaging and Ubuntu CA trust store documentation for secure package delivery.