Python: Force Virtual Environments to use system certificate store on Windows

Question

My company uses a VPN, which does not work with the PIP certificate check out of the box. When I install a package with pip install asyncio, it gives me the following error:

Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)'))': /simple/asyncio/

In the system wide python installation, this can be circumvented by using:

pip install --trusted-host pypi.org --trusted-host pypi.python.org --trusted-host files.pythonhosted.org pip-system-certs

After that, the Windows certificate store is used, which contains the CA for the VPN. Now, I can just use:

pip install asyncio 

and all works fine.

However, if I use a virtual environment, I am back in the same position of having to first install pip-system-certs:

python -m venv C:\location\of\venv
cd C:\location\of\venv
.\Scripts\activate
pip install asyncio

Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)'))': /simple/asyncio/

This makes working with systems like Poetry very difficult, because all configurations need to change.

Is there a way to force all Python Virtual Environments on my system to use the system certificate store?

Answer 1

I had a similar problem, but on a Linux machine. What solved the problem for me was the following:

1. check where the certificate is stored in your "global" environment

2. check the same for the virtual environment. Use, for example

   >> python3 -m certifi
   output is something like this:
   /path/to/global_env/certificate1.crt
   

3. replace the virtual environment's certificate with that of the global environment

   mv /path/to/global_env/certificate1.crt /path/to/virtualenv/certificate2.pem
   

Now the same certificate file is used in both environments.