tooolbox/blog/Python pip install 시 SSL 인증서 에러
security2025-03-20·8·144/348

Python pip install 시 SSL 인증서 에러

Fixing SSL certificate verification errors when running pip install — covering corporate proxies, outdated CA bundles, and system-level certificate issues.

Python pip install 시 SSL 인증서 에러

Introduction

Few errors are as frustrating as watching pip install fail because Python cannot verify an SSL certificate. This is especially common in corporate environments where traffic passes through a TLS-inspecting proxy, or on older systems where the CA certificate bundle is outdated.

I hit this error repeatedly while setting up a quantitative trading backend on a fresh VPS in Lisbon. The server was running Ubuntu 22.04, but the Python installation was compiled from source without proper CA certificate paths. Every pip install command failed with a certificate error.

Environment

# Server
Ubuntu 22.04 LTS
Python 3.11.5 (compiled from source)
pip 23.2.1

# Corporate network scenario
Windows 11
Python 3.12.3 (official installer)
Behind Zscaler proxy

Problem

Here is the typical error output:

$ pip install requests

WARNING: pip is configured with locations that require TLS/SSL, however the ssl module in Python is not available.
Collecting requests
  WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate (_ssl.c:1006)'))': /simple/requests/
  WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED]'))': /simple/requests/
ERROR: Could not find a version that satisfies the requirement requests (from versions: none)
ERROR: No matching distribution found for requests

Or the shorter variant:

$ pip install flask
ERROR: Exception:
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/pip/_internal/cli/command.py", line 104, in main
    ...
  File "/usr/lib/python3/dist-packages/pip/_internal/commands/install.py", line 376, in run
    ...
pip._internal.exceptions.InstallationError: Could not find a version that satisfies for requirement flask

And sometimes you see:

pip is configured with locations that require TLS/SSL, however the ssl module in Python is not available.

Analysis

There are three distinct root causes:

Root Cause 1: Missing or outdated CA certificates. Python uses the system's CA certificate bundle to verify HTTPS connections. If the bundle is missing or outdated, pip cannot verify PyPI's certificate.

Root Cause 2: Corporate proxy performing TLS inspection. Corporate proxies like Zscaler, Bluecoat, or Squid intercept HTTPS traffic and re-sign it with their own CA. Python does not trust this CA by default.

Root Cause 3: Python compiled from source without SSL support. When you compile Python from source without the libssl-dev package, the ssl module is not available at all.

Check which issue you have:

import ssl
print(ssl.get_default_verify_paths())

If this throws an error, your Python has no SSL support. If it prints paths but the files do not exist, you need to install CA certificates.

Solution

Fix 1: Install CA certificates on Ubuntu/Debian

sudo apt update
sudo apt install ca-certificates
sudo update-ca-certificates

Fix 2: Install CA certificates on CentOS/RHEL

sudo yum install ca-certificates
sudo update-ca-trust force-enable

Fix 3: For corporate proxy environments

Create a pip configuration file:

# ~/.pip/pip.conf (Linux)
# %APPDATA%\pip\pip.ini (Windows)

[global]
trusted-host = pypi.org
               files.pythonhosted.org
               pypi.python.org

Or set the environment variable:

# Linux/macOS
export PIP_TRUSTED_HOST="pypi.org files.pythonhosted.org pypi.python.org"
pip install requests

# Windows PowerShell
$env:PIP_TRUSTED_HOST = "pypi.org files.pythonhosted.org pypi.python.org"
pip install requests

For corporate CA certificates, add them to Python's trust store:

# Get the corporate CA certificate (ask your IT team)
# Save it as corporate-ca.crt

# Add to system trust store
sudo cp corporate-ca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

# Or set via environment variable
export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt

Fix 4: For source-compiled Python without SSL

# First, install SSL development headers
sudo apt install libssl-dev zlib1g-dev

# Then recompile Python
cd Python-3.11.5
./configure --with-ssl
make
sudo make install

Fix 5: Temporary bypass (not recommended for production)

pip install --trusted-host pypi.org --trusted-host files.pythonhosted.org requests

Lessons Learned

  • Never permanently bypass SSL verification in production. It defeats the purpose of HTTPS and exposes you to man-in-the-middle attacks.
  • Always install ca-certificates on fresh servers before trying to install Python packages.
  • Corporate environments need explicit CA configuration. Ask your IT team for the proxy CA certificate and add it properly.
  • Use pip config to set trusted hosts rather than passing flags to every command.
  • If you compile Python from source, always ensure libssl-dev is installed first.

This blog does not accept any external sponsorships, affiliate marketing, or ad revenue.