SSLCertVerificationError on pypi.org: Which CA Bundle Does pip Actually Trust?

Answer to the Core Question

pip itself does not perform TLS verification. It delegates HTTPS to the requests / urllib3 stack, which in turn uses Python’s ssl module. The effective trust store is therefore determined by the following precedence (from highest to lowest):

• 1. REQUESTS_CA_BUNDLE environment variable – if set, requests loads this file and ignores all other CA sources.
• 2. The bundled certifi CA file – requests defaults to certifi.where() when the certifi package is importable.
• 3. SSL_CERT_FILE / SSL_CERT_DIR environment variables – these influence Python’s ssl.get_default_verify_paths() and are honored by the ssl module when no certifi bundle is used.
• 4. System OpenSSL default paths – the build‑time defaults of the OpenSSL library linked with CPython.

In practice, if certifi is installed in the interpreter that runs pip, it will shadow the system OpenSSL defaults for all code that goes through requests. However, environment variables can still override this, and code that uses ssl directly (outside requests) will fall back to the OpenSSL defaults unless overridden by SSL_CERT_FILE or SSL_CERT_DIR.

How to Identify the Effective Trust Store Without Changing Anything

1. Confirm the interpreter pip is using. Run:

   pip --version
   # Example output: pip 24.0 from /usr/local/lib/python3.12/site-packages/pip (python 3.12)

   This tells you the exact Python executable and its library path.

2. Inspect the interpreter’s SSL defaults and certifi location. Execute the following one‑liner with the same Python binary that pip uses (replace /usr/local/bin/python3.12 with the path from the previous step):

   /usr/local/bin/python3.12 - <<'PY'
   import ssl, certifi, os
   print('certifi bundle:', certifi.where())
   print('ssl default verify paths:', ssl.get_default_verify_paths())
   print('env overrides:', {k: v for k, v in os.environ.items() if k in ('SSL_CERT_FILE', 'SSL_CERT_DIR', 'REQUESTS_CA_BUNDLE')})
   PY

   The output shows which CA file certifi points to, the system OpenSSL paths, and any environment variables that might override them.

3. Use pip’s verbose network logging to see the file actually used. Run a pip command with maximum verbosity:

   pip install --verbose some‑package
   # Look for a line similar to:
   #   Using CA file: /path/to/ca-bundle.crt
   

   The path logged is the one that requests passed to ssl for verification.

4. Cross‑check the three sources. If the CA file logged by pip matches the path printed by certifi.where(), certifi is in effect. If it matches one of the paths from ssl.get_default_verify_paths(), the system OpenSSL store is being used. If it matches an environment variable you set (e.g., SSL_CERT_FILE or REQUESTS_CA_BUNDLE), that variable overrides the others.

When to Ask for More Information

If you observe a mismatch between the CA file reported by pip and the paths printed in step 2, it may indicate that pip is being invoked by a different Python interpreter than the one you inspected. In that case, provide the output of pip --version and the environment variables present when you run pip.

Key Takeaway

pip’s trust store is a combination of requests’ default to certifi, any REQUESTS_CA_BUNDLE override, and finally the system OpenSSL defaults. The simplest way to determine which one is active is to inspect the interpreter’s SSL defaults, the certifi location, and the environment variables, and then confirm with pip’s verbose logging.