pypa/pip · error · OSError

Could not find the TLS certificate file, invalid path: {conn

Error message

Could not find the TLS certificate file, invalid path: {conn.cert_file}

What it means

HTTPAdapter.cert_verify raises OSError when client-certificate authentication (mTLS) is requested via cert= but the certificate file path does not exist on disk. conn.cert_file is the first element of the cert tuple (or the scalar cert string) and is checked with os.path.exists before the TLS handshake.

Source

Thrown at src/pip/_vendor/requests/adapters.py:356

            if not os.path.isdir(cert_loc):
                conn.ca_certs = cert_loc
            else:
                conn.ca_cert_dir = cert_loc
        else:
            conn.cert_reqs = "CERT_NONE"
            conn.ca_certs = None
            conn.ca_cert_dir = None

        if cert:
            if not isinstance(cert, basestring):
                conn.cert_file = cert[0]
                conn.key_file = cert[1]
            else:
                conn.cert_file = cert
                conn.key_file = None
            if conn.cert_file and not os.path.exists(conn.cert_file):
                raise OSError(
                    f"Could not find the TLS certificate file, "
                    f"invalid path: {conn.cert_file}"
                )
            if conn.key_file and not os.path.exists(conn.key_file):
                raise OSError(
                    f"Could not find the TLS key file, invalid path: {conn.key_file}"
                )

    def build_response(self, req: PreparedRequest, resp: Any) -> Response:
        """Builds a :class:`Response <requests.Response>` object from a urllib3
        response. This should not be called from user code, and is only exposed
        for use when subclassing the
        :class:`HTTPAdapter <requests.adapters.HTTPAdapter>`

        :param req: The :class:`PreparedRequest <PreparedRequest>` used to generate the response.
        :param resp: The urllib3 response object.
        :rtype: requests.Response
        """

View on GitHub (pinned to d7d0d0a394)

Solutions

Verify the certificate file path is correct and readable by the process.
Use an absolute path for the cert file.
Ensure the file is mounted/copied into the runtime environment (Docker volume, CI secret).
If using a combined PEM, confirm it contains both CERTIFICATE and PRIVATE KEY blocks.

Example fix

# before
requests.get(url, cert='./client.crt')  # file not in cwd

# after
requests.get(url, cert='/etc/ssl/mtls/client.crt')

Defensive patterns

Strategy: validation

Validate before calling

import os
cert_path = cert if isinstance(cert, str) else (cert[0] if cert else None)
if cert_path and not os.path.exists(cert_path):
    raise FileNotFoundError(f'client cert not found: {cert_path}')
requests.get(url, cert=cert)

Try / catch

try:
    resp = requests.get(url, cert=cert)
except OSError as e:
    if 'TLS certificate file' in str(e):
        raise RuntimeError(f'missing client cert: {e}') from e
    raise

Prevention

Use absolute paths for client certs.
Verify cert files exist and are mounted before issuing the request.

When it happens

Trigger: Calling requests with cert='/path/client.pem' (or cert=('/path/client.crt','/path/client.key')) where the certificate file does not exist; common in mTLS setups where the cert path is misconfigured or the file was not mounted into the container.

Common situations: Container/CI runs where the cert file is not mounted; typo in the cert path; relative path resolved against the wrong working directory; rotated certs where the old file was removed.

Related errors

AI-assisted analysis of pypa/pip@d7d0d0a394 (2026-08-04). Data as JSON: /data/errors/dcaeaed336b3c1d8.json. Report an issue: GitHub.