astral-sh/uv · error · anyhow::Error

pip-compile's `--client-cert` is unsupported (uv doesn't sup

Error message

pip-compile's `--client-cert` is unsupported (uv doesn't support dedicated client certificates)

What it means

pip-compile's `--client-cert` passes a TLS client certificate (mTLS) for authenticated registry access. uv has no per-call client-certificate option — its TLS configuration comes from `--cert`/`SSL_CERT_FILE` for CAs and does not support dedicated client certificates — so the compatibility validator returns an error rather than silently dropping your credential config.

Source

Thrown at crates/uv-cli/src/compat.rs:111

                        "pip-compile's `--resolver=backtracking` has no effect (uv always backtracks)"
                    );
                }
                Resolver::Legacy => {
                    return Err(anyhow!(
                        "pip-compile's `--resolver=legacy` is unsupported (uv always backtracks)"
                    ));
                }
            }
        }

        if self.max_rounds.is_some() {
            return Err(anyhow!(
                "pip-compile's `--max-rounds` is unsupported (uv always resolves until convergence)"
            ));
        }

        if self.client_cert.is_some() {
            return Err(anyhow!(
                "pip-compile's `--client-cert` is unsupported (uv doesn't support dedicated client certificates)"
            ));
        }

        if self.emit_trusted_host {
            return Err(anyhow!(
                "pip-compile's `--emit-trusted-host` is unsupported"
            ));
        }

        if self.no_emit_trusted_host {
            warn_user!(
                "pip-compile's `--no-emit-trusted-host` has no effect (uv never emits trusted hosts)"
            );
        }

        if self.config.is_some() {
            return Err(anyhow!(

View on GitHub (pinned to f1a42680ff)

Solutions

Remove `--client-cert` from the uv invocation.
For mTLS needs, front the registry with a TLS-terminating proxy and point uv at it, or perform that resolution step with a tool that supports client certificates.
Watch uv's TLS docs/changelog — dedicated client certificates are a known gap; subscribe to the tracking issue rather than working around silently.

Example fix

# before
uv pip compile --client-cert client.pem requirements.in

# after (terminate mTLS at a proxy)
# proxy presents client cert upstream, serves plain HTTPS to uv
uv pip compile --index-url https://proxy.internal/simple requirements.in

Defensive patterns

Strategy: validation

Validate before calling

def check_mtls_flags(argv: list[str]) -> None:
    if any(a == "--client-cert" or a.startswith("--client-cert=") for a in argv):
        raise ValueError(
            "uv does not support client certificates; terminate mTLS at a proxy or use another tool for this step"
        )

Prevention

Verify registry TLS requirements before migrating mTLS pipelines to uv.
Centralize TLS termination (proxy or internal CA via --cert/SSL_CERT_FILE) so no tool needs client certs.
Watch uv release notes for client-certificate support before reintroducing the flag.

When it happens

Trigger: `uv pip compile --client-cert client.pem requirements.in` against a private index that requires mutual TLS. The sibling `--client-cert` on `uv pip sync` fails identically (compat.rs:231).

Common situations: Corporate Artifactory/Nexus registries behind mTLS; CI pipelines migrating from pip-tools where `PIP_CLIENT_CERT`/`--client-cert` was standard; scripts shared across pip and uv tooling.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of astral-sh/uv@f1a42680ff (2026-08-16). Data as JSON: /api/errors/f5b715d10f5c8431. Report an issue: GitHub.