{"id":"8c02c39122adbcf0","repo":"pypa/pip","slug":"could-not-find-a-suitable-tls-ca-certificate-bundl","errorCode":null,"errorMessage":"Could not find a suitable TLS CA certificate bundle, invalid path: {cert_loc}","messagePattern":"Could not find a suitable TLS CA certificate bundle, invalid path: (.+?)","errorType":"exception","errorClass":"OSError","httpStatus":null,"severity":"error","filePath":"src/pip/_vendor/requests/adapters.py","lineNumber":332,"sourceCode":"        :param conn: The urllib3 connection object associated with the cert.\n        :param url: The requested URL.\n        :param verify: Either a boolean, in which case it controls whether we verify\n            the server's TLS certificate, or a string, in which case it must be a path\n            to a CA bundle to use\n        :param cert: The SSL certificate to verify.\n        \"\"\"\n        if url.lower().startswith(\"https\") and verify:\n            cert_loc = None\n\n            # Allow self-specified cert location.\n            if verify is not True:\n                cert_loc = verify\n\n            if not cert_loc:\n                cert_loc = DEFAULT_CA_BUNDLE_PATH\n\n            if not cert_loc or not os.path.exists(cert_loc):\n                raise OSError(\n                    f\"Could not find a suitable TLS CA certificate bundle, \"\n                    f\"invalid path: {cert_loc}\"\n                )\n\n            conn.cert_reqs = \"CERT_REQUIRED\"\n\n            if not os.path.isdir(cert_loc):\n                conn.ca_certs = cert_loc\n            else:\n                conn.ca_cert_dir = cert_loc\n        else:\n            conn.cert_reqs = \"CERT_NONE\"\n            conn.ca_certs = None\n            conn.ca_cert_dir = None\n\n        if cert:\n            if not isinstance(cert, basestring):\n                conn.cert_file = cert[0]","sourceCodeStart":314,"sourceCodeEnd":350,"githubUrl":"https://github.com/pypa/pip/blob/d7d0d0a39494e28ec1c407bd0680e4a4d1067791/src/pip/_vendor/requests/adapters.py#L314-L350","documentation":"HTTPAdapter.cert_verify raises OSError when, for an HTTPS request with verification enabled, the resolved CA certificate bundle path does not exist on disk. The path is either the user-supplied verify= string or the vendored DEFAULT_CA_BUNDLE_PATH; a missing file means TLS verification cannot proceed.","triggerScenarios":"Calling requests.get(url, verify='/path/cacert.pem') where that file does not exist; or verify=True (default) but the vendored cacert.pem shipped with the requests/pip install is missing or corrupted (e.g. a broken packaging, partial install, or overridden REQUESTS_CA_BUNDLE pointing nowhere).","commonSituations":"REQUESTS_CA_BUNDLE / CURL_CA_BUNDLE env var set to a wrong path; a Docker image that omitted the cacert.pem; verify pointed at a cert that was deleted or never copied; vendored certifi metadata broken after a partial upgrade.","solutions":["Point verify (or REQUESTS_CA_BUNDLE) to an existing CA bundle file or directory.","Unset REQUESTS_CA_BUNDLE/CURL_CA_BUNDLE if they reference a missing file, to fall back to the bundled certifi.","Reinstall the package (pip install --force-reinstall requests/certifi) to restore cacert.pem.","Only as a last resort, pass verify=False (insecure) to bypass, understanding the security implications."],"exampleFix":"# before\nrequests.get('https://example.com', verify='/etc/ssl/missing.pem')\n\n# after\nimport certifi\nrequests.get('https://example.com', verify=certifi.where())","handlingStrategy":"validation","validationCode":"import os\nca = verify if isinstance(verify, str) else None\nif ca and not os.path.exists(ca):\n    raise FileNotFoundError(f'CA bundle not found: {ca}')\nrequests.get(url, verify=ca)","typeGuard":null,"tryCatchPattern":"try:\n    resp = requests.get(url, verify=verify_path)\nexcept OSError as e:\n    if 'CA certificate bundle' in str(e):\n        import certifi\n        resp = requests.get(url, verify=certifi.where())\n    else:\n        raise","preventionTips":["Validate verify paths with os.path.exists before the request.","Prefer certifi.where() over hand-configured bundle paths.","Sanity-check REQUESTS_CA_BUNDLE/CURL_CA_BUNDLE at startup."],"tags":["requests","tls","ssl","certificates","config"],"analyzedSha":"d7d0d0a39494e28ec1c407bd0680e4a4d1067791","analyzedAt":"2026-08-04T20:55:04.259Z","schemaVersion":2}