brew installation of Python 3.6.1: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed

Question

I installed python 3.6 using

brew install python3

and tried to download a file with six.moves.urllib.request.urlretrieve from an https, but it throws the error

ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:749)

In the Python installation (from .pkg), the README indicates that one needs to run the Install Certificates.command after the installation to

install certifi
symlink the certification path to certify path

to be able to use certificates.

However, in brew install, this file does not exist and it does not seem to be run.

Executing `/Applications/Python\ 3.6/Install\ Certificates.command` in Terminal fixed this problem with my homebrew python3 installation. — David Douglas, Feb 04 '19 at 15:07
Given the popularity of this question, I fielded [a issue to brew](https://github.com/Homebrew/homebrew-core/issues/42198#issue-470594759). — Jorge Leitao, Jul 19 '19 at 22:54
`export SSL_CERT_DIR=/etc/ssl/certs` worked for me in Mac OS Big Sur. — TrigonaMinima, Oct 08 '21 at 20:54

score 111 · Accepted Answer · answered Jun 20 '17 at 09:42

It seems that, for some reason, Brew has not run the Install Certificates.command that comes in the Python3 bundle for Mac. The solution to this issue is to run the following script (copied from Install Certificates.command) after brew install python3:

# install_certifi.py
#
# sample script to install or update a set of default Root Certificates
# for the ssl module.  Uses the certificates provided by the certifi package:
#       https://pypi.python.org/pypi/certifi

import os
import os.path
import ssl
import stat
import subprocess
import sys

STAT_0o775 = ( stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR
             | stat.S_IRGRP | stat.S_IWGRP | stat.S_IXGRP
             | stat.S_IROTH |                stat.S_IXOTH )


def main():
    openssl_dir, openssl_cafile = os.path.split(
        ssl.get_default_verify_paths().openssl_cafile)

    print(" -- pip install --upgrade certifi")
    subprocess.check_call([sys.executable,
        "-E", "-s", "-m", "pip", "install", "--upgrade", "certifi"])

    import certifi

    # change working directory to the default SSL directory
    os.chdir(openssl_dir)
    relpath_to_certifi_cafile = os.path.relpath(certifi.where())
    print(" -- removing any existing file or link")
    try:
        os.remove(openssl_cafile)
    except FileNotFoundError:
        pass
    print(" -- creating symlink to certifi certificate bundle")
    os.symlink(relpath_to_certifi_cafile, openssl_cafile)
    print(" -- setting permissions")
    os.chmod(openssl_cafile, STAT_0o775)
    print(" -- update complete")

if __name__ == '__main__':
    main()

What does one do, if one does not have root access / sudo rights? Thanks. — tommy.carstensen, Feb 16 '18 at 01:17
I ran the above command and it seemed to work successfully, but I am still getting the error. Any ideas on how to debug this? — devo, Jul 24 '18 at 02:12
For reference, the source of this script is here: https://github.com/python/cpython/blob/master/Mac/BuildScript/resources/install_certificates.command — Sampo, Mar 06 '19 at 10:17
@tommy.carstensen you will have to just run this for your own virtual environments — deed02392, Sep 30 '19 at 05:46
I had to add `import ssl; ssl._create_default_https_context = ssl._create_stdlib_context` to my code for it to work. — Rafael Miquelino, Apr 11 '20 at 13:32
This post also helped with ssl errors on mac. https://stackoverflow.com/a/57630381/3380256 — mfink, May 17 '20 at 19:26
This was required for me to start development of my Slack App. Thank you! — Simon Tower, Dec 14 '21 at 23:01

score 29 · Answer 2 · answered Apr 21 '18 at 08:00

29

My solution for Mac OS X:

1) Upgrade to Python 3.6.5 using the native app Python installer downloaded from the official Python language website https://www.python.org/downloads/

I've found that this installer is taking care of updating the links and symlinks for the new Python a lot better than homebrew.

2) Install a new certificate using "./Install Certificates.command" which is in the refreshed Python 3.6 directory

cd "/Applications/Python 3.6/" sudo "./Install Certificates.command"

answered Apr 21 '18 at 08:00

Claude COULOMBE

3,026
1
30
35

1

Thanks! Worked for me, and I'm on 3.8 (changed the command appropriately to the Python 3.8 directory). – user7804781 Dec 12 '19 at 20:47
There is no Python folder in my Applications, and I could not locate it on my machine. Any ideas how can I fix the issue for my case? – talha06 Dec 25 '19 at 08:38
2

@talha06 - In order to know where Python is located on your computer, open the python shell typing `python` or `python3` then `import sys` and `print('\n'.join(sys.path))` Or you can type this command in the terminal `python -c "import sys; print('\n'.join(sys.path))"` – Claude COULOMBE Dec 26 '19 at 05:09
Thanks worked for me with tiny change: `$ cd /Applications/Python 3.8/` `$ sudo ./Install\ Certificates.command` Happy Coding :) – Mehady Apr 10 '21 at 13:19
After 2 dys of searching. this is what worked for me. Didn't even make it to the approved solution. – insaineyesay Feb 03 '22 at 23:34

score 20 · Answer 3 · answered Apr 18 '20 at 19:00

find out default cafile:

python -c 'import ssl; print(ssl.get_default_verify_paths().openssl_cafile)'

/Applications/Xcode.app/Contents/Developer/Library/Frameworks/Python3.framework/Versions/3.7/etc/ssl/cert.pem

sudo mkdir -p /Applications/Xcode.app/Contents/Developer/Library/Frameworks/Python3.framework/Versions/3.7/etc/ssl/certs

find out ca file of certifi

python -c 'import certifi; print(certifi.where())'

'/usr/local/lib/python3.7/site-packages/certifi/cacert.pem'

copy to

sudo cp /usr/local/lib/python3.7/site-packages/certifi/cacert.pem
/Applications/Xcode.app/Contents/Developer/Library/Frameworks/Python3.framework/Versions/3.7/etc/ssl/certs/cert.pem

This did not work for me on a conda python environment, using conda python. I tried copying the certs in three different directories: ssl, ssl/crt, etc/ssl/certs . I have found no solution so far. — user1255933, Nov 23 '20 at 20:00

score 8 · Answer 4 · edited Apr 20 '20 at 16:58

8

For temporary, following will disable the ssl checking,

import ssl
ssl._create_default_https_context = ssl._create_unverified_context

edited Apr 20 '20 at 16:58

Tasneem Hyder

170
1
1
7

answered Apr 14 '20 at 23:59

Mak Insane

129
2
8

score 0 · Answer 5 · answered Jan 15 '22 at 08:07

If you need to make your local root certificate (e.g. local_RootCA.crt) become trusted by python, you can add it into the end of certifi/cacert.pem file:

cat local_RootCA.crt >> `python -c 'import certifi; print(certifi.where())'`

That solution works good for macos brew python 3 installation as well.

brew installation of Python 3.6.1: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed

5 Answers5

Linked