Debian 12 – pip install fails with SSL certificate verify failed – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Python dependencies cannot be installed, delaying deployments and CI jobs.

Environment & Reproduction

Common behind TLS inspection proxies or outdated CA stores in virtual environments.

Root Cause Analysis

pip/requests trust path does not include valid CA chain for package index endpoints.

Quick Triage

Check system clock, CA bundle freshness, and pip index URL settings.

Step-by-Step Diagnosis

Run: python3 -m pip config list -v; python3 -m pip debug –verbose; openssl s_client -connect pypi.org:443 -servername pypi.org </dev/null | head -n 20.

Solution – Primary Fix

Run: sudo apt install –reinstall ca-certificates python3-certifi -y; python3 -m pip install –upgrade pip; configure trusted corporate CA if applicable.

Solution – Alternative Approaches

Mirror Python packages internally and point pip to authenticated internal index.

Verification & Acceptance Criteria

pip install for target package succeeds without SSL certificate verification errors.

Rollback Plan

Restore previous pip.conf and certificate bundles if custom trust changes break connectivity.

Prevention & Hardening

Automate CA updates and pin approved package indexes in CI and runtime images.

Related Errors & Cross-Refs

Related to CERTIFICATE_VERIFY_FAILED, TLSV1_ALERT, and hostname mismatch failures.

Related tutorial: View the step-by-step tutorial for debian-12.

View all debian-12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

pip HTTPS certificates guide and Debian Python packaging documentation.