Pip install SSLError: connection broken fix (proxy/SSL)

What's actually happening here

Pip uses SSL to talk to PyPI. When the SSL handshake fails — because your system time is wrong, or your certificate store is outdated, or a proxy intercepts the connection — you get this error:

SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed'))

The message says "connection broken" but really it's a certificate trust issue. Each fix below addresses one root cause.

Quick fix (30 seconds): Check your system clock

SSL certificates have validity windows. If your system time is off by more than a few hours, the cert looks expired or not-yet-valid. This is the #1 cause I see on fresh Linux installs with no NTP sync.

1. On Windows 10/11: Right-click clock → Adjust date/time → toggle "Set time automatically" on, then click "Sync now".
2. On macOS: System Settings → General → Date & Time → turn on "Set time and date automatically".
3. On Ubuntu/Debian: sudo timedatectl set-ntp yes

Try your pip install again. If it works, you're done. Skip the rest.

Moderate fix (5 minutes): Update pip's certificate bundle

Pip ships with its own certificate bundle via the certifi package. Sometimes that bundle is old, or your system's CA certificates are out of sync. The fix is to force a refresh.

python -m pip install --upgrade certifi
python -m pip install --upgrade pip setuptools wheel

On macOS with Homebrew, also do:

brew reinstall ca-certificates

On Ubuntu/Debian:

sudo apt update && sudo apt install --reinstall ca-certificates

The reason this works: pip uses certifi's cert store first. Upgrading it pulls the latest trusted roots from Mozilla. On macOS, Homebrew maintains its own cert store that can conflict with Python's — reinstalling it fixes that.

Test with: python -m pip install requests. No error? Done.

If you're behind a corporate proxy (15 minutes)

Corporate proxies often replace SSL certs with their own. Pip doesn't trust them by default. You have three options here, from cleanest to dirtiest.

Option A: Tell pip about your proxy cert

Get your proxy's CA certificate (usually from your IT team or export it from your browser). Then tell pip to trust it:

pip config set global.cert /path/to/your/proxy-ca.pem

This works globally. On Windows the path looks like C:\Users\you\certs\proxy.pem. On macOS/Linux it's /etc/ssl/certs/ or a custom path.

Option B: Set proxy explicitly

If your proxy uses HTTP (not HTTPS), pip's SSL check might still fail because the proxy intercepts. Set the proxy explicitly in pip's config:

pip config set global.proxy http://proxy.company.com:8080

On Windows you can also set environment variables:

set HTTP_PROXY=http://proxy.company.com:8080
set HTTPS_PROXY=http://proxy.company.com:8080

Note: HTTPS_PROXY often still uses http:// because the proxy does the SSL termination, not your machine.

Option C (last resort): Skip SSL verification

Only do this if you understand the risk — you're trusting the network, not PyPI's certificate. Add this flag for a one-time install:

python -m pip install --trusted-host pypi.org --trusted-host files.pythonhosted.org package_name

To make it permanent (not recommended, but sometimes the only way when IT won't give you the cert):

pip config set global.trusted-host "pypi.org files.pythonhosted.org"

I've seen this needed on Windows 10 with Zscaler proxies that replace every cert. If you do this, also set PIP_REQUIRE_VIRTUALENV=false in your environment so you don't accidentally install system-wide packages without noticing.

Still broken? Check Python 3.6 or older

Python 3.6 hit end-of-life in 2021. Its SSL module doesn't handle modern TLS 1.3 or some cipher suites. If you can't upgrade Python, install the pyopenssl package to override the SSL layer:

python -m pip install --trusted-host pypi.org pyopenssl

Then set this environment variable:

set PIP_USE_PYOPENSSL=1

On macOS 10.15 (Catalina) with Python 3.6 from the system, this is almost always the fix. Apple's OpenSSL is ancient.

When none of this works

Rarely, your network is actively blocking PyPI. Test with:

curl -I https://pypi.org

If that times out or gives a gateway error, talk to your network admin. Nothing we do in pip can fix a blocked connection.

Also check your pip.ini (Windows) or ~/.config/pip/pip.conf (Linux/macOS) for any leftover config from previous fixes. Delete the whole [global] section if you're unsure, then start from the quick fix again.