Astro CLI Error: [SSL: CERTFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate

Astronomer Astronomer on Windows
1

Problem Statement: When I restart my Airflow environment with the Astro CLI locally or deploy to Astro I get an SSL error from pip basically saying it doesn’t trust the host it’s trying to find the required package in. This might even happen with pypi.org.

ERROR: Could not install packages due to an OSError: HTTPSConnectionPool(host= 'w0cvsblobprodsu6weus7.blob.core.windows.net.... [SSL:CERTFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)')))

When does this happen: Some environments, especially Windows have stricter rules for which SSL certificates it trusts.

Solution:

  • To avoid this you may need configure your firewall to allow SSL/TLS traffic.
  • OR you can add the host as trusted-host to your pip.conf file manually as shown below:
[global]
extra-index-url = 
trusted-host = pypi.org
                       pypi.python.org
                       pip.astronomer.io
                       w0csvblobdevrt9weru8.blob.core.windows.net
1 Like
2

Hi, I believe I am having this issue, thanks for the explanation. I am only aware of how to edit the requirements.txt file for astro CLI. Where would I place or reference a pip.conf file so that “astro dev (re)start” would detect and use it?

I have tried adding

COPY pip.conf /root/.config/pip/pip.conf

to the Dockerfile, with no change in the error.

3

Hey @arunaj

Welcome to Astronomer Forum!

To answer your question, Astro CLI uses the astro user to run Airflow. So, ideally the path to keep the pip.conf file should be /home/astro/.pip/pip.conf.

You can also find this path by running this command python3 -m pip config debug in your Astro Docker container.

Hope this helps!

Thanks
Manmeet

1 Like