pip安装失败，并显示“连接错误：[SSL：CERTIFICATE_VERIFY_FAILED]证书验证失败（_ssl.c：598）”

本文翻译自：pip install fails with “connection error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:598)”

I am very new to Python and trying to > pip install linkchecker on Windows 7. Some notes: 我是Python的新手，并尝试> pip install linkchecker在Windows 7上> pip install linkchecker 。一些注意事项：

• pip install is failing no matter the package. 无论软件包如何，pip安装都会失败。 For example, > pip install scrapy also results in the SSL error. 例如， > pip install scrapy也会导致SSL错误。
• Vanilla install of Python 3.4.1 included pip 1.5.6. 原始安装的Python 3.4.1包含pip 1.5.6。 The first thing I tried to do was install linkchecker. 我尝试做的第一件事是安装linkchecker。 Python 2.7 was already installed, it came with ArcGIS. Python 2.7已经安装，它是ArcGIS附带的。 python and pip were not available from the command line until I installed 3.4.1. 在我安装3.4.1之前，无法从命令行使用python和pip 。
• > pip search linkchecker works. > pip search linkchecker起作用。 Perhaps that is because pip search does not verify the site's SSL certificate. 可能是因为点子搜索无法验证站点的SSL证书。
• I am in a company network but we do not go through a proxy to reach the Internet. 我在公司网络中，但是我们没有通过代理访问Internet。
• Each company computer (including mine) has a Trusted Root Certificate Authority that is used for various reasons including enabling monitoring TLS traffic to https://google.com . 每台公司计算机（包括我的计算机）都具有受信任的根证书颁发机构，出于各种原因使用该证书颁发机构，包括启用监视到https://google.com的 TLS流量。 Not sure if that has anything to do with it. 不确定是否与此有关。

Here are the contents of my pip.log after running pip install linkchecker : 这是运行pip install linkchecker之后我的pip.log的内容：

Downloading/unpacking linkchecker
  Getting page https://pypi.python.org/simple/linkchecker/
  Could not fetch URL https://pypi.python.org/simple/linkchecker/: connection error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:598)
  Will skip URL https://pypi.python.org/simple/linkchecker/ when looking for download links for linkchecker
  Getting page https://pypi.python.org/simple/
  Could not fetch URL https://pypi.python.org/simple/: connection error: HTTPSConnectionPool(host='pypi.python.org', port=443): Max retries exceeded with url: /simple/ (Caused by : Request-sent)
  Will skip URL https://pypi.python.org/simple/ when looking for download links for linkchecker
  Cannot fetch index base URL https://pypi.python.org/simple/
  URLs to search for versions for linkchecker:
  * https://pypi.python.org/simple/linkchecker/
  Getting page https://pypi.python.org/simple/linkchecker/
  Could not fetch URL https://pypi.python.org/simple/linkchecker/: connection error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:598)
  Will skip URL https://pypi.python.org/simple/linkchecker/ when looking for download links for linkchecker
  Could not find any downloads that satisfy the requirement linkchecker
Cleaning up...
  Removing temporary dir C:\Users\jcook\AppData\Local\Temp\pip_build_jcook...
No distributions at all found for linkchecker
Exception information:
Traceback (most recent call last):
  File "C:\Python34\lib\site-packages\pip\basecommand.py", line 122, in main
    status = self.run(options, args)
  File "C:\Python34\lib\site-packages\pip\commands\install.py", line 278, in run
    requirement_set.prepare_files(finder, force_root_egg_info=self.bundle, bundle=self.bundle)
  File "C:\Python34\lib\site-packages\pip\req.py", line 1177, in prepare_files
    url = finder.find_requirement(req_to_install, upgrade=self.upgrade)
  File "C:\Python34\lib\site-packages\pip\index.py", line 277, in find_requirement
    raise DistributionNotFound('No distributions at all found for %s' % req)
pip.exceptions.DistributionNotFound: No distributions at all found for linkchecker

---

#1楼

参考：https://stackoom.com/question/1l11j/pip安装失败-并显示-连接错误-SSL-CERTIFICATE-VERIFY-FAILED-证书验证失败-ssl-c

---

#2楼

You can specify a cert with this param: 您可以使用以下参数指定证书：

pip --cert /etc/ssl/certs/FOO_Root_CA.pem install linkchecker

See: Docs » Reference Guide » pip 请参阅： 文档»参考指南»点

If specifying your company's root cert doesn't work maybe the cURL one will work: http://curl.haxx.se/ca/cacert.pem 如果指定您公司的根证书无效，则可能无法使用cURL： http : //curl.haxx.se/ca/cacert.pem

You must use a PEM file and not a CRT file. 您必须使用PEM文件而不是CRT文件。 If you have a CRT file you will need to convert the file to PEM There are reports in the comments that this now works with a CRT file but I have not verified. 如果您有CRT文件，则需要将其转换为PEM 。注释中有报告说，该报告现在可用于CRT文件，但我尚未验证。

Also check: SSL Cert Verification . 还要检查： SSL证书验证 。

---

#3楼

You can try to bypass the SSL error by using http instead of https. 您可以尝试使用http而不是https来绕过SSL错误。 Of course this is not optimal in terms of security , but if you are in a hurry it should do the trick: 当然，就安全性而言，这并不是最佳选择 ，但是如果您急于赶快，那就可以采取以下措施：

pip install --index-url=http://pypi.python.org/simple/ linkchecker

---

#4楼

我通过删除我的点子并安装了较旧版本的点子来解决此问题： https : //pypi.python.org/pypi/pip/1.2.1

---

#5楼

Had the same problem trying pip install ftputil with ActivePython 2.7.8, ActivePython 3.4.1, and "stock" Python 3.4.2 on 64-bit Windows 7 Enterprise. 尝试在64位Windows 7 Enterprise上使用ActivePython 2.7.8，ActivePython 3.4.1和“ pip install ftputil ” Python 3.4.2 pip install ftputil相同的问题。 All attempts failed with the same errors as OP. 所有尝试均以与OP相同的错误失败。

Worked around the problem for Python 3.4.2 by downgrading to pip 1.2.1: easy_install pip==1.2.1 (see https://stackoverflow.com/a/16370731/234235 ). 通过降级为pip 1.2.1解决了Python 3.4.2的问题： easy_install pip==1.2.1 （请参阅https://stackoverflow.com/a/16370731/234235 ）。 Same fix also worked for ActivePython 2.7.8. 同样的修复也适用于ActivePython 2.7.8。

The bug, reported in March 2013, is still open: https://github.com/pypa/pip/issues/829 . 该bug于2013年3月报告，目前仍在打开： https : //github.com/pypa/pip/issues/829 。

---

#6楼

I recently ran into this problem because of my company's web content filter that uses its own Certificate Authority so that it can filter SSL traffic. 我最近遇到了这个问题，因为我公司的Web内容过滤器使用自己的证书颁发机构，以便可以过滤SSL流量。 PIP doesn't seem to be using the system's CA certificates in my case, producing the error you mention. 在我的情况下，PIP似乎没有使用系统的CA证书，从而产生了您提到的错误。 Downgrading PIP to version 1.2.1 presented its own set of problems later on, so I went back to the original version that came with Python 3.4. 后来将PIP降级到1.2.1版会带来一系列问题，因此我回到了Python 3.4附带的原始版本。

My workaround is quite simple: use easy_install . 我的解决方法非常简单：使用easy_install 。 Either it doesn't check the certs (like the old PIP version), or it knows to use the system certs because it works every time for me and I can still use PIP to uninstall packages installed with easy_install. 它要么不检查证书（例如旧的PIP版本），要么知道使用系统证书，因为它每次都对我有用，我仍然可以使用PIP卸载使用easy_install安装的软件包。

If that doesn't work and you can get access to a network or computer that doesn't have the issue, you could always setup your own personal PyPI server: how to create local own pypi repository index without mirror? 如果那行不通，并且您可以访问没有问题的网络或计算机，则可以始终设置自己的个人PyPI服务器： 如何在没有镜像的情况下创建本地自己的pypi存储库索引？

I almost did that until I tried using easy_install as a last ditch effort. 在尝试使用easy_install作为最后的努力之前，我几乎做到了。