pip "SSL: CERTIFICATE_VERIFY_FAILED" on macOS: the installer that does not use the system trust store
verbatim errorpip is configured with locations that require TLS/SSL, however the ssl module in Python is not able to verify the certificate.
Could not fetch URL https://pypi.org/simple/numpy/: There was a problem confirming the ssl certificate: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)
Problem
Fresh Mac, fresh Python (python.org installer), first pip install:
pip is configured with locations that require TLS/SSL, however the ssl module in Python is not able to verify the certificate.
Could not fetch URL https://pypi.org/simple/numpy/: There was a problem confirming the ssl certificate: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)curl works. The browser works. pip does not — on a machine whose TLS is otherwise fine.
Root cause
Python's ssl module uses OpenSSL, which has no default trust store on macOS — it needs a CA bundle pointed at it. The python.org installer ships OpenSSL without one and provides a post-install step people never run. The corporate-proxy variant (re-signed traffic with a company root) fails identically and adds the fun of working from some directories and not others depending on which proxies see the request.
fix preview — first 1 of 2 lines (bash), truncated:
/Applications/Python\ 3.12/Install\ Certificates.command
… 1 more line in the fix🔒 the fix — including 4 code blocks — is members-only. $1/mo unlocks everything.