pypa/pip · error · OSError

Could not find a suitable TLS CA certificate bundle, invalid

Error message

Could not find a suitable TLS CA certificate bundle, invalid path: {cert_loc}

What it means

HTTPAdapter.cert_verify raises OSError when, for an HTTPS request with verification enabled, the resolved CA certificate bundle path does not exist on disk. The path is either the user-supplied verify= string or the vendored DEFAULT_CA_BUNDLE_PATH; a missing file means TLS verification cannot proceed.

Source

Thrown at src/pip/_vendor/requests/adapters.py:332

        :param conn: The urllib3 connection object associated with the cert.
        :param url: The requested URL.
        :param verify: Either a boolean, in which case it controls whether we verify
            the server's TLS certificate, or a string, in which case it must be a path
            to a CA bundle to use
        :param cert: The SSL certificate to verify.
        """
        if url.lower().startswith("https") and verify:
            cert_loc = None

            # Allow self-specified cert location.
            if verify is not True:
                cert_loc = verify

            if not cert_loc:
                cert_loc = DEFAULT_CA_BUNDLE_PATH

            if not cert_loc or not os.path.exists(cert_loc):
                raise OSError(
                    f"Could not find a suitable TLS CA certificate bundle, "
                    f"invalid path: {cert_loc}"
                )

            conn.cert_reqs = "CERT_REQUIRED"

            if not os.path.isdir(cert_loc):
                conn.ca_certs = cert_loc
            else:
                conn.ca_cert_dir = cert_loc
        else:
            conn.cert_reqs = "CERT_NONE"
            conn.ca_certs = None
            conn.ca_cert_dir = None

        if cert:
            if not isinstance(cert, basestring):
                conn.cert_file = cert[0]

View on GitHub (pinned to d7d0d0a394)

Solutions

Point verify (or REQUESTS_CA_BUNDLE) to an existing CA bundle file or directory.
Unset REQUESTS_CA_BUNDLE/CURL_CA_BUNDLE if they reference a missing file, to fall back to the bundled certifi.
Reinstall the package (pip install --force-reinstall requests/certifi) to restore cacert.pem.
Only as a last resort, pass verify=False (insecure) to bypass, understanding the security implications.

Example fix

# before
requests.get('https://example.com', verify='/etc/ssl/missing.pem')

# after
import certifi
requests.get('https://example.com', verify=certifi.where())

Defensive patterns

Strategy: validation

Validate before calling

import os
ca = verify if isinstance(verify, str) else None
if ca and not os.path.exists(ca):
    raise FileNotFoundError(f'CA bundle not found: {ca}')
requests.get(url, verify=ca)

Try / catch

try:
    resp = requests.get(url, verify=verify_path)
except OSError as e:
    if 'CA certificate bundle' in str(e):
        import certifi
        resp = requests.get(url, verify=certifi.where())
    else:
        raise

Prevention

Validate verify paths with os.path.exists before the request.
Prefer certifi.where() over hand-configured bundle paths.
Sanity-check REQUESTS_CA_BUNDLE/CURL_CA_BUNDLE at startup.

When it happens

Trigger: Calling requests.get(url, verify='/path/cacert.pem') where that file does not exist; or verify=True (default) but the vendored cacert.pem shipped with the requests/pip install is missing or corrupted (e.g. a broken packaging, partial install, or overridden REQUESTS_CA_BUNDLE pointing nowhere).

Common situations: REQUESTS_CA_BUNDLE / CURL_CA_BUNDLE env var set to a wrong path; a Docker image that omitted the cacert.pem; verify pointed at a cert that was deleted or never copied; vendored certifi metadata broken after a partial upgrade.

Related errors

AI-assisted analysis of pypa/pip@d7d0d0a394 (2026-08-04). Data as JSON: /data/errors/8c02c39122adbcf0.json. Report an issue: GitHub.