Quick workaround: Ubuntu package utilities apt-cache
and apt-get
allow to search and install thousands of the common Python packages ($ sudo apt-get install python-<packagename>
). They will be older than what comes from pip
though, some may not be found in Ubuntu repositories.
The error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version
can be reproduced by running pip with -v
(for verbosity), along with SSLError
, No distributions found
, Max retries exceeded
messages.
Python for Linux uses the system-supplied OpenSSL lib. curl
and pip
(and wget
) also depend on the system OpenSSL for establishing SSL connections (use $ openssl version
command). But TLS 1.1 support isn't enough for pip any more.
TLS v1.2 requires OpenSSL 1.0.1 (or later) to function, but a minimum of OpenSSL 1.0.2 is generally recommended.
Curl's libcurl supports TLS 1.2 since curl version 7.34, but older curl versions should be able to connect only if you had OpenSSL version 1.0.2 (or later). So, both pip
and the curl
commands you've tried fail because the operating system's underlying OpenSSL library version is below 1.0.1
(see $ openssl version
command) which does not support TLS 1.2 required. To see it in Python interpreter:
>>> import ssl
>>> ssl.OPENSSL_VERSION
'OpenSSL 0.9.8o 01 Jun 2010'
>>> ssl.PROTOCOL_TLSv1_2
AttributeError: 'module' object has no attribute 'PROTOCOL_TLSv1_2'
Another part of the problem is that Python < 2.7.9 (or <3.4 in Python3) itself has ssl
module that doesn't support PROTOCOL_TLSv1_2, so pip
cannot use it, even if openssl was up-to-date. In Ubuntu repositories, Python 2.7.9 first appeared in 15.04 (Vivid Vervet), and Python 3.4.2 in 14.10 (Utopic Unicorn), which means you cannot upgrade system Python safely without upgrading your whole OS components. Python versions 2.7.9+ and 3.4+ ship newer pip with them by default.
You are lucky in a sense that with Ubuntu 12.04 being a former LTS (long-term support) version, you always have an option to apt-get upgrade
your whole OS and jump directly to the next LTS release which would upgrade everything from OpenSSL to Python and its system-wide modules. In your exact version of Ubuntu 12.04 (Precise Pangolin) repository, OpenSSL 1.0.1-4 is available (security updates backported), so you could try $ sudo apt-get update && sudo apt-get install openssl libssl-dev
but it may lead to the system upgrade by dependencies, and makes no sense without Python upgrade anyway. Keeping your original Ubuntu-shipped Python version intact allows to avoid breaking dependencies because many OS components rely on OS-shipped Python version.
You could compile from sources your own non-system OpenSSL, then also your standalone non-system Python, linking it against the OpenSSL you have just compiled, but this approach requires more "-dev" debian packages to be installed, and may be unfeasible due to various limitations.
Fortunately, it all can be solved without compiling or upgrading Python (and the whole system), by installing several Python packages manually -- the detailed step-by-step guide is available here on Stackoverflow. The cryptography manylinux1 wheel ships the most recent statically-linked OpenSSL library that will enable pip
(v10+) and allow you to continue to use Ubuntu 12.04 without major upgrading hassle.