Could not install packages due to an EnvironmentError: Could not find a suitable TLS CA certificate bundle, invalid path

Question

I get this error:

Could not install packages due to an EnvironmentError: Could not find a suitable TLS CA certificate bundle, invalid path: /home/yosra/Desktop/CERT.RSA

When I run: $ virtualenv venv

So I put a random CERT.RSA on the Desktop which worked and I created my virtual environment, but then when I run: pip install -r requirements.txt

I got this one:

Could not install packages due to an EnvironmentError: HTTPSConnectionPool(host='github.com', port=443): Max retries exceeded with url: /KristianOellegaard/django-hvad/archive/2.0.0-beta.tar.gz (Caused by SSLError(SSLError(0, 'unknown error (_ssl.c:3715)'),))

I feel that these 2 errors are linked to each other, but I want to know how can I fix the first one?

Answer 1

If you're on Mac (mine is 10.13.6), use the following command:

(security find-certificate -a -p ls /System/Library/Keychains/SystemRootCertificates.keychain &&        security find-certificate -a -p ls /Library/Keychains/System.keychain) > $HOME/.mac-ca-roots

Then do modify .bashrc with

export REQUESTS_CA_BUNDLE="$HOME/.mac-ca-roots"

Then do

$ source ~/.bashrc

Answer 2

In Windows 10, 1. Find the location of certifi with following commands to check if installed already

import certifi
certifi.where()

2. Note down the path of cacert.pem file

3. Search for the pip.ini file in windows explorer and edit the file in notepad and set the path = <file path of cacert.pem >

Answer 3

You need to allow pip to reference to the correct certificate. check the certificate first;

python -c "import certifi; print(certifi.where())"

Then first test it manually;

pip install -r requirements.txt --cert=<the above certificate path>

If that works fine, then update this path on pip.conf file located at $HOME/.pip/pip.conf (or %APPDATA%\pip\pip.ini on Windows). e.g.

[global]
cert = /usr/local/share/ca-certificate/mycert.crt

Answer 4

I received this error while running the command as "pip install flask" in Pycharm.

If you look at the error, you will see that the error points out to "packages due to an EnvironmentError: Could not find a suitable TLS CA certificate bundle -- Invalid path".

I solved this by removing the environment variable "REQUESTS_CA_BUNDLE" OR you can just change the name of the environment variable "REQUESTS_CA_BUNDLE" to some other name.

Restart your Pycharm and this should be solved.

Thank you !

Answer 5

We get this all the time for various 'git' actions. We have our own CA + intermediary and we don't customize our software installations enough to accomodate that fact.

Our general fix is update your ca-bundle.crt with the CA cert pems via either concatenation or replacement.

e.g. cat my_cert_chain.pem >> $(python -c "import certifi; print(certifi.where())")

This works great if you have an /etc/pki/tls/certs directory, but with python the python -c "import certifi; print(certifi.where())" tells you the location of python's ca-bundle.crt file.

Althought it's not a purist python answer, since we're not adding a new file / path, it solves alot of other certificate problems with other software when you understand the underlying issue.

I recommended concatenating in this case as I don't know what else the file is used for vis-a-vis pypi.