{"id":"dcaeaed336b3c1d8","repo":"pypa/pip","slug":"could-not-find-the-tls-certificate-file-invalid-p","errorCode":null,"errorMessage":"Could not find the TLS certificate file, invalid path: {conn.cert_file}","messagePattern":"Could not find the TLS certificate file, invalid path: (.+?)","errorType":"exception","errorClass":"OSError","httpStatus":null,"severity":"error","filePath":"src/pip/_vendor/requests/adapters.py","lineNumber":356,"sourceCode":"\n            if not os.path.isdir(cert_loc):\n                conn.ca_certs = cert_loc\n            else:\n                conn.ca_cert_dir = cert_loc\n        else:\n            conn.cert_reqs = \"CERT_NONE\"\n            conn.ca_certs = None\n            conn.ca_cert_dir = None\n\n        if cert:\n            if not isinstance(cert, basestring):\n                conn.cert_file = cert[0]\n                conn.key_file = cert[1]\n            else:\n                conn.cert_file = cert\n                conn.key_file = None\n            if conn.cert_file and not os.path.exists(conn.cert_file):\n                raise OSError(\n                    f\"Could not find the TLS certificate file, \"\n                    f\"invalid path: {conn.cert_file}\"\n                )\n            if conn.key_file and not os.path.exists(conn.key_file):\n                raise OSError(\n                    f\"Could not find the TLS key file, invalid path: {conn.key_file}\"\n                )\n\n    def build_response(self, req: PreparedRequest, resp: Any) -> Response:\n        \"\"\"Builds a :class:`Response <requests.Response>` object from a urllib3\n        response. This should not be called from user code, and is only exposed\n        for use when subclassing the\n        :class:`HTTPAdapter <requests.adapters.HTTPAdapter>`\n\n        :param req: The :class:`PreparedRequest <PreparedRequest>` used to generate the response.\n        :param resp: The urllib3 response object.\n        :rtype: requests.Response\n        \"\"\"","sourceCodeStart":338,"sourceCodeEnd":374,"githubUrl":"https://github.com/pypa/pip/blob/d7d0d0a39494e28ec1c407bd0680e4a4d1067791/src/pip/_vendor/requests/adapters.py#L338-L374","documentation":"HTTPAdapter.cert_verify raises OSError when client-certificate authentication (mTLS) is requested via cert= but the certificate file path does not exist on disk. conn.cert_file is the first element of the cert tuple (or the scalar cert string) and is checked with os.path.exists before the TLS handshake.","triggerScenarios":"Calling requests with cert='/path/client.pem' (or cert=('/path/client.crt','/path/client.key')) where the certificate file does not exist; common in mTLS setups where the cert path is misconfigured or the file was not mounted into the container.","commonSituations":"Container/CI runs where the cert file is not mounted; typo in the cert path; relative path resolved against the wrong working directory; rotated certs where the old file was removed.","solutions":["Verify the certificate file path is correct and readable by the process.","Use an absolute path for the cert file.","Ensure the file is mounted/copied into the runtime environment (Docker volume, CI secret).","If using a combined PEM, confirm it contains both CERTIFICATE and PRIVATE KEY blocks."],"exampleFix":"# before\nrequests.get(url, cert='./client.crt')  # file not in cwd\n\n# after\nrequests.get(url, cert='/etc/ssl/mtls/client.crt')","handlingStrategy":"validation","validationCode":"import os\ncert_path = cert if isinstance(cert, str) else (cert[0] if cert else None)\nif cert_path and not os.path.exists(cert_path):\n    raise FileNotFoundError(f'client cert not found: {cert_path}')\nrequests.get(url, cert=cert)","typeGuard":null,"tryCatchPattern":"try:\n    resp = requests.get(url, cert=cert)\nexcept OSError as e:\n    if 'TLS certificate file' in str(e):\n        raise RuntimeError(f'missing client cert: {e}') from e\n    raise","preventionTips":["Use absolute paths for client certs.","Verify cert files exist and are mounted before issuing the request."],"tags":["requests","tls","mtls","certificates","config"],"analyzedSha":"d7d0d0a39494e28ec1c407bd0680e4a4d1067791","analyzedAt":"2026-08-04T20:55:04.259Z","schemaVersion":2}