Astro CLI Error: [SSL: CERTFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate

Problem Statement: When I restart my Airflow environment with the Astro CLI locally or deploy to Astro I get an SSL error from pip basically saying it doesn’t trust the host it’s trying to find the required package in. This might even happen with

ERROR: Could not install packages due to an OSError: HTTPSConnectionPool(host= ' [SSL:CERTFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)')))

When does this happen: Some environments, especially Windows have stricter rules for which SSL certificates it trusts.


  • To avoid this you may need configure your firewall to allow SSL/TLS traffic.
  • OR you can add the host as trusted-host to your pip.conf file manually as shown below:
extra-index-url = 
trusted-host =
1 Like

Hi, I believe I am having this issue, thanks for the explanation. I am only aware of how to edit the requirements.txt file for astro CLI. Where would I place or reference a pip.conf file so that “astro dev (re)start” would detect and use it?

I have tried adding

COPY pip.conf /root/.config/pip/pip.conf

to the Dockerfile, with no change in the error.

Hey @arunaj

Welcome to Astronomer Forum!

To answer your question, Astro CLI uses the astro user to run Airflow. So, ideally the path to keep the pip.conf file should be /home/astro/.pip/pip.conf.

You can also find this path by running this command python3 -m pip config debug in your Astro Docker container.

Hope this helps!


1 Like