SSL certificate error with pip 21.0.1

[rajesh0therascal]

pip version

21.0.1

Python version

3.7

OS

Windows 10

Additional information

After upgrading pip to latest version i.e. 21.0.1, I am unable to install any other packages.

Description

I am able to install packages with previous versions (19.0.3) of pip. Problem is with only 21.0.1.

Expected behavior

No response

How to Reproduce

Step 1 :

python -m pip install --upgrade pip 

Step 2:

 pip install matplotlib 

Output

WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1076)'))': /simple/matplotlib/
WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1076)'))': /simple/matplotlib/
WARNING: Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1076)'))': /simple/matplotlib/
WARNING: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1076)'))': /simple/matplotlib/
WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1076)'))': /simple/matplotlib/
Could not fetch URL https://pypi.org/simple/matplotlib/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/matplotlib/ (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1076)'))) - skipping
ERROR: Could not find a version that satisfies the requirement matplotlib
ERROR: No matching distribution found for matplotlib
Could not fetch URL https://pypi.org/simple/pip/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/pip/ (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1076)'))) - skipping

Code of Conduct

• I agree to follow the PSF Code of Conduct #10101

[bastiaan85]

Do you have a internet proxy configured at the Config Panel -> Internet Options? If so disable it and try again. If it then times out, add the proxy on the command line using --proxy http://address:port.

[rajesh0therascal]

@bastiaan85 Not helping me. Similar output. I am able to install with previous versions. Once i upgrade pip to 21.0.1, packages stop installing.

[bastiaan85]

What does it print out when you launch a PowerShell and try the three commands mentioned in #9216 (comment) ?

[rajesh0therascal]

@bastiaan85 It prints out my proxy server and proxy port number.

[bastiaan85]

If it's printing it in the third command, then it means you didn't disable the proxy properly. If it prints it only in the first and/or second command, then verify that the url set there starts with 'http' and not 'https'.

[rajesh0therascal]

@bastiaan85 If I disable proxy, i wont be able to connect to internet. My PC is behind proxy and all other applications will stop working.

[bastiaan85]

I understand, but I don't know of a another way to be able to let pip download something via a http-only proxy. As the bug here is that urllib3 will assume the proxy it found in the system settings (third command) is a https-proxy and will not fall back to http when its request fails (that's why you see the SSL errors in pip). So until this is fixed in urllib3 the workaround is to disable the system proxy, set the proxy in the pip command line using --proxy http://address:port to let pip download its things, then enable the system proxy again.

[anujsuchchal]

I was fighting with my organization's networking team from last one month to remove this error and finally I got rid off it by using --proxy http://address:port
Thanks a lot!

[CrazyBoyFeng]

I downgrade pip to 20.2.3 and it works fine.

[muellert]

I have the same problem on Linux with Python 3.9.1, and running pip install (20.2.3) does not fix it. I am behind an SSL proxy which I can't circumvent, so I can only re-install Python and then everything I installed since (except for a newer pip).

[bastiaan85]

I have the same problem on Linux with Python 3.9.1, and running pip install (20.2.3) does not fix it. I am behind an SSL proxy which I can't circumvent, so I can only re-install Python and then everything I installed since (except for a newer pip).

That can't be the same issue. The mentioned issue is Windows users behind a HTTP proxy, as there the 'system proxy' is set using the Internet Options panel, which then gets picked up by urllib3, assumed to be a HTTPS proxy, so it uses a SSL client, which then fails on the proxy (being a dumb HTTP endpoint) not responding with a proper SSL handshake. This is represented by the SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number message. This 'assumption bug' didn't occur before 21.0. So judging by both your OS as the fact that downgrading didn't help means you are experiencing another connectivity issue.

This could be related to either a schema mismatch (http:// in the environment variables while https:// should be used) or that you are in fact not behind a SSL proxy at all and thus do need to use http:// as the proxy url schema. I would recommend running tcpdump or wireshark to capture the traffic during a working example (eg using your browser to visit a site) then compare the traffic when running pip.

[muellert]

My proxy setup is correct, and furtnermore, out of my control (corporate networking here). I've successfully installed a number of packages with the original version of pip. But after upgrading, I got the SSL protocol mismatch problem, and after downgrading, my connections just time out. I would like to debug further, but don't know how.