'pip install' throws SSL Certificate Error

Version:

Not specific to Domino version

Issue:

A pip install fails with

connection error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed

Root Cause:

By default pip does not make use of system certificates:
https://pip.pypa.io/en/stable/topics/https-certificates/

So this could occur if you are behind a firewall or require a proxy which is tunneled or one which otherwise may strip the certificate. 

Resolution:

If you're behind a network configuration that strips the certificate you may need to give this parameter to pip or pip.conf:

trusted-host

With the cli:

pip install --trusted-host pypi.org --trusted-host pypi.python.org --trusted-host files.pythonhosted.org pip <package>

and for easy access to pip, add this to pip.conf:

[global]
trusted-host = pypi.python.org
               pypi.org
               files.pythonhosted.org

Notes/Information:

This can even occur for dockerfile instructions in Compute Environments, but the same workaround applies, example:

A RUN pip install fails with

SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1131)'

Try this dockerfile instruction:

USER root
RUN pip install --trusted-host github.com --trusted-host codeload.github.com https://github.com/dominodatalab/python-domino/archive/master.zip