brew installation of Python 3.6.1: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed


I installed python 3.6 using

brew install python3

and tried to download a file with six.moves.urllib.request.urlretrieve from an https, but it throws the error

ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:749)

In the Python installation (from .pkg), the README indicates that one needs to run the Install Certificates.command after the installation to

  1. install certifi
  2. symlink the certification path to certify path

to be able to use certificates.

However, in brew install, this file does not exist and it does not seem to be run.

Asked By: Jorge Leitao



It seems that, for some reason, Brew has not run the Install Certificates.command that comes in the Python3 bundle for Mac. The solution to this issue is to run the following script (copied from Install Certificates.command) after brew install python3:

# sample script to install or update a set of default Root Certificates
# for the ssl module.  Uses the certificates provided by the certifi package:

import os
import os.path
import ssl
import stat
import subprocess
import sys

STAT_0o775 = ( stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR
             | stat.S_IRGRP | stat.S_IWGRP | stat.S_IXGRP
             | stat.S_IROTH |                stat.S_IXOTH )

def main():
    openssl_dir, openssl_cafile = os.path.split(

    print(" -- pip install --upgrade certifi")
        "-E", "-s", "-m", "pip", "install", "--upgrade", "certifi"])

    import certifi

    # change working directory to the default SSL directory
    relpath_to_certifi_cafile = os.path.relpath(certifi.where())
    print(" -- removing any existing file or link")
    except FileNotFoundError:
    print(" -- creating symlink to certifi certificate bundle")
    os.symlink(relpath_to_certifi_cafile, openssl_cafile)
    print(" -- setting permissions")
    os.chmod(openssl_cafile, STAT_0o775)
    print(" -- update complete")

if __name__ == '__main__':
Answered By: Jorge Leitao

My solution for Mac OS X:

1) Upgrade to Python 3.6.5 using the native app Python installer downloaded from the official Python language website

I’ve found that this installer is taking care of updating the links and symlinks for the new Python a lot better than homebrew.

2) Install a new certificate using “./Install Certificates.command” which is in the refreshed Python 3.6 directory

cd “/Applications/Python 3.6/”
sudo “./Install Certificates.command”

Answered By: Claude COULOMBE

For temporary, following will disable the ssl checking,

import ssl
ssl._create_default_https_context = ssl._create_unverified_context
Answered By: Mak Insane
  • find out default cafile:
python -c 'import ssl; print(ssl.get_default_verify_paths().openssl_cafile)'


sudo mkdir -p /Applications/
  • find out ca file of certifi
python -c 'import certifi; print(certifi.where())'


  • copy to
sudo cp /usr/local/lib/python3.7/site-packages/certifi/cacert.pem
Answered By: Ken

If you need to make your local root certificate (e.g. local_RootCA.crt) become trusted by python, you can add it into the end of certifi/cacert.pem file:

cat local_RootCA.crt >> `python -c 'import certifi; print(certifi.where())'`

That solution works good for macos brew python 3 installation as well.

Answered By: rfedorov

positionning SSL_CERT_FILE env var to your ca file also works and it is not invasive.

Answered By: G. Ghez
Categories: questions Tags: ,
Answers are sorted by their score. The answer accepted by the question owner as the best is marked with
at the top-right corner.