13

I’m having some issues getting conda to respect my proxy declaration. I’ve copied the proxy strings from the examples in the conda docs and replaced the urls with my own. I’ve also exported the HTTP_PROXY and HTTPS_PROXY with strings that I know work. My ~/.condarc file looks like:

proxy_servers:
    http: http://<proxyaddress>:<port>
    https: https://<proxyaddress>:<port>

Any suggestions?

EDIT: conda version: 3.14.1

looks like the proxy string is actually fine. The real issue that didn't come up at first is that conda isn't using the ca-cert that I need for due to our corporate proxy. The specific error, which appears when I attempt to install a package, is:

Error: Connection error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581): ...
LISTERINE
  • 923
  • 1
  • 9
  • 14

4 Answers4

15
conda config --set ssl_verify false
Remi Guan
  • 21,506
  • 17
  • 64
  • 87
Frank Wang
  • 1,462
  • 3
  • 17
  • 39
  • 6
    One of my requirements was to still use SSL. Setting ssl_verify to false is very unsafe when using conda to download as the connection can be interfered with (ex. someone can force you to download malicious data). – LISTERINE Feb 23 '17 at 20:57
14

I faced the same problem on Mac OS X and with Miniconda. After trying many of the proposed solutions for hours I found that I needed to correctly set Condas environment (specifically requests that conda uses to make HTTPS connections) to use the Root certificate that my company provided rather than the generic ones that Conda provides.

Expanding on @LISTERINE's answer here is how I could solved it:

  1. Open Chrome, got to any website, click on the lock icon on the left of the URL. Click on «Certificate» on the dropdown. In the next window you see a stack of certificates. The uppermost (aka top line in window) is the root certificate (e.g. Zscaler Root CA in my case, yours will very likely be a different one).

enter image description here

  1. Open Mac OS keychain, click on «Certificates» and choose among the many certificates the root certificate that you just identified. Export this to any folder of your choosing.

  2. Convert this certificate with openssl: openssl x509 -inform der -in /path/to/your/certificate.cer -out /path/to/converted/certificate.pem

  3. For a quick check set your shell to acknowledge the certificate: export REQUESTS_CA_BUNDLE=/path/to/converted/certificate.pem

  4. To set this permanently you have two options:

    A. open your shell profile (.bshrs or e.g. .zshrc) and add this line: export REQUESTS_CA_BUNDLE=/path/to/converted/certificate.pem.

    ~~OR~~

    B. run conda config --set ssl_verify /path/to/converted/certificate.pem which will add the location of the certificate to ~/.condarc

Now exit your terminal/shell and reopen. Check again. You should be set and Conda should work fine.

Nate
  • 13
  • 3
petezurich
  • 9,280
  • 9
  • 43
  • 57
  • 1
    Worked like a gem. Thanks! – KaliCharan Apr 28 '20 at 19:29
  • 1
    Fails on MacOS Monterey 12.5.1. Followed this exactly and still getting CondaHTTPError: HTTP 000 CONNECTION FAILED for url . Error says to retry: Tried multiple times over several hours. Still no luck. – user1255933 Sep 06 '22 at 19:57
12

I figured it out so I thought I'd come back and report.

I'm not sure how to make conda use a specific cert, but conda uses requests for it's web requests. You can inject a cert bundle into requests' path by setting the environment variable REQUESTS_CA_BUNDLE.

so I ran:

export REQUESTS_CA_BUNDLE=/usr/local/share/ca-certificates/<my-cert-name>

and now conda can get through our proxy!

LISTERINE
  • 923
  • 1
  • 9
  • 14
  • Found the solution here: http://stackoverflow.com/questions/33699577/conda-update-failed-ssl-error-ssl-certificate-verify-failed-certificate-ver?rq=1 – Eugene Yan Feb 06 '16 at 00:38
0

It worked for me, by editing .condarc file as below.

channels:
    - defaults
#ssl_verify: C:\Users\ravikumk\certs\ca.crt

ssl_verify: false

# Show channel URLs when displaying what is going to be downloaded and
# in 'conda list'. The default is False.
show_channel_urls: True
allow_other_channels: True
Josef
  • 2,869
  • 2
  • 22
  • 23
krkc
  • 81
  • 8
  • One of my requirements was to still use SSL. Setting ssl_verify to false is very unsafe when using conda to download as the connection can be interfered with (ex. someone can force you to download malicious data). – LISTERINE Jul 05 '21 at 12:47
  • Hey @LISTERINE, If that's the case, simply comment ssl_verify: false, then uncomment the statement above ssl_verify: . in other way you can set those ssl certs globally. – krkc Jul 05 '21 at 15:13