![如何解决安装 PIP 时 SSL 证书错误?](https://linux22.com/image/138535/%E5%A6%82%E4%BD%95%E8%A7%A3%E5%86%B3%E5%AE%89%E8%A3%85%20PIP%20%E6%97%B6%20SSL%20%E8%AF%81%E4%B9%A6%E9%94%99%E8%AF%AF%EF%BC%9F.png)
当我尝试使用从 bootstrap.pypa.io 下载的软件包安装 PIP 时,出现 SSL 证书错误。我关注了其他帖子,并尝试通过禁用证书签入/etc/python/cert-verification.cfg
并尝试使用来做到这PYTHONHTTPSVERIFY=0
一点,但这似乎不起作用,最后我决定问这个问题,因为其他帖子并不能真正帮助我的情况。
我有以下环境:
OS: centos-release-7-5.1804.1.el7.centos.x86_64
Python 包:
[root@localhost ~]# yum list installed|grep python
dbus-python.x86_64 1.1.1-9.el7 @anaconda
libselinux-python.x86_64 2.5-12.el7 @anaconda
newt-python.x86_64 0.52.15-4.el7 @anaconda
python.x86_64 2.7.5-69.el7_5 @updates
python-backports.x86_64 1.0-8.el7 @base
python-backports-ssl_match_hostname.noarch
python-configobj.noarch 4.7.2-7.el7 @anaconda
python-decorator.noarch 3.4.0-3.el7 @anaconda
python-firewall.noarch 0.4.4.4-14.el7 @anaconda
python-gobject-base.x86_64 3.22.0-1.el7_4.1 @anaconda
python-iniparse.noarch 0.4-9.el7 @anaconda
python-ipaddress.noarch 1.0.16-2.el7 @base
python-libs.x86_64 2.7.5-69.el7_5 @updates
python-linux-procfs.noarch 0.4.9-3.el7 @anaconda
python-perf.x86_64 3.10.0-862.9.1.el7 @updates
python-pycurl.x86_64 7.19.0-19.el7 @anaconda
python-pyudev.noarch 0.15-9.el7 @anaconda
python-schedutils.x86_64 0.4-6.el7 @anaconda
python-setuptools.noarch 0.9.8-7.el7 @base
python-slip.noarch 0.4.0-4.el7 @anaconda
python-slip-dbus.noarch 0.4.0-4.el7 @anaconda
python-urlgrabber.noarch 3.10-8.el7 @anaconda
python-wheel.noarch 0.24.0-2.el7 @epel
rpm-python.x86_64 4.11.3-32.el7 @anaconda
以下是步骤和错误:
[root@localhost ~]# curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 1604k 100 1604k 0 0 73257 0 0:00:22 0:00:22 --:--:-- 72502
[root@localhost ~]#
[root@localhost ~]# PYTHONHTTPSVERIFY=0 python get-pip.py
Collecting pip
Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)'),)': /packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl
Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)'),)': /packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl
Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)'),)': /packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl
Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)'),)': /packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl
Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)'),)': /packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl
Could not install packages due to an EnvironmentError: HTTPSConnectionPool(host='files.pythonhosted.org', port=443): Max retries exceeded with url: /packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl (Caused by SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)'),))
我想补充一点,Python 是随操作系统预安装的,我正在尝试直接安装 PIP。我尝试从 epel-repo 安装,但我得到的是旧版本,当我尝试更新它时(因为没有更新,我在安装新版本的 PIP 时不断收到错误)我得到相同的错误。
有人能建议如何解决这个问题吗?
答案1
你的情况有些不对劲。我只是在 CentOS 7.5 VM 中执行了与您完全相同的命令,并且它们运行没有问题:
操作系统版本$ cat /etc/redhat-release
CentOS Linux release 7.5.1804 (Core)
下载
$ curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 1604k 100 1604k 0 0 1676k 0 --:--:-- --:--:-- --:--:-- 1676k
安装
$ PYTHONHTTPSVERIFY=0 python get-pip.py
Collecting pip
Downloading https://files.pythonhosted.org/packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl (1.3MB)
100% |████████████████████████████████| 1.3MB 7.4MB/s
Collecting wheel
Downloading https://files.pythonhosted.org/packages/81/30/e935244ca6165187ae8be876b6316ae201b71485538ffac1d718843025a9/wheel-0.31.1-py2.py3-none-any.whl (41kB)
100% |████████████████████████████████| 51kB 4.4MB/s
Installing collected packages: pip, wheel
Found existing installation: pip 10.0.1
Uninstalling pip-10.0.1:
Successfully uninstalled pip-10.0.1
Successfully installed pip-18.0 wheel-0.31.1
解决方法
要解决此问题,您可以在 Linux/Unix 上修改以下文件以告诉pip
仅信任此主机:
$ cat ~/.pip/pip.conf
[global]
trusted-host = files.pythonhosted.org
bootstrap.pypa.io
或者只是一次性完成:bootstrap.pypa.io
我为什么需要这个?
您所在的国家/地区或公司防火墙可能会将自身作为受信任的主机插入,并干扰数据来源的实际主机。这通常会对 SSL 证书造成严重破坏,因为它们包含明确创建的主机/域名。
调试技巧
当您在使用 Python 时遇到此类问题时,您始终可以通过-vvv
开关启用详细日志记录:
$ PYTHONHTTPSVERIFY=0 python -vvv get-pip.py |& less
# installing zipimport hook
import zipimport # builtin
# installed zipimport hook
# trying /usr/lib64/python2.7/site.so
# trying /usr/lib64/python2.7/sitemodule.so
# trying /usr/lib64/python2.7/site.py
# /usr/lib64/python2.7/site.pyc matches /usr/lib64/python2.7/site.py
import site # precompiled from /usr/lib64/python2.7/site.pyc
# trying /usr/lib64/python2.7/os.so
# trying /usr/lib64/python2.7/osmodule.so
...
import pip._vendor.html5lib._ihatexml # loaded from Zip /tmp/tmpYDym4g/pip.zip/pip/_vendor/html5lib/_ihatexml.py
import pip._vendor.html5lib.treebuilders.etree # loaded from Zip /tmp/tmpYDym4g/pip.zip/pip/_vendor/html5lib/treebuilders/etree.py
Downloading https://files.pythonhosted.org/packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl (1.3MB)
Installing collected packages: pip
Found existing installation: pip 18.0
Uninstalling pip-18.0:
Successfully uninstalled pip-18.0
...
get-pip.py
通过这样做,您可以看到脚本被绊倒的URL 。