# pip and SSL certificate errors

I am trying to install a library via pip. I have a problem with SSL certificate, even when using the --cert. Trying this on windows (pip version 1.5.4,python version 2.7.6):

pip --cert C:\tmp\cacert.pem install robotframework-archivelibrary --proxy http://myproxy


Getting page https://pypi.python.org/simple/robotframework-archivelibrary/ Could not fetch URL https://pypi.python.org/simple/robotframework-archivelibrary/: connection error: [Errno 1] _ssl.c:507: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

Any ideas?

I had similar error messages due to our corporate firewall intercepting SSL (i.e. a transparent SSL proxy). I exported the root CA cert that signs the firewall certificate in .pem format and appended it to the following file:

C:\Python27\Lib\site-packages\pip\_vendor\requests\cacert.pem


That resolved my issue. Your issue might not be exactly the same, but if you get the right CA certificates into the above cacert.pem I'm sure you can get passed your SSL certificate verification failure.

• Could you elaborate on how do one export root CA cert? – Eran Jan 21 '15 at 13:08
• Yes, I'm unclear on which root CA is exported to where -- are we grabbing the source repo's root CA and passing it on the command line, as well as exporting to the firewall via the cacert.pem file in Python's site-packages? – rholmes Sep 10 '15 at 1:58
• I tried 5 different cacert.pem files in python folders but eventually one of them worked: C:\Python27\Lib\site-packages\certifi\cacert.pem One of them also got conda to work – endolith May 6 '16 at 15:16

Since --cert doesn't work for you, probably you're using the wrong certificate file.

Most likely you're behind some corporation proxy, so you should export your root certificate by going to the failing URL (e.g. https://pypi.python.org/simple/robotframework-archivelibrary/, see: How to save a remote server SSL certificate locally as a file).

If it's in CER format, convert it into PEM.

Then use that PEM file, e.g.

pip --cert root-cert.pem install robotframework-archivelibrary


Add this to your pip config, which on Windows is C:\Users\<user>\pip\pip.ini.

[global]
trusted-host = pypi.python.org
proxy = <proxy>:<port>


Find your proxy by following these directions.