pip cannot fetch URL because of an error with the SSL certificate

Question

All of a sudden pip, Python's package manager, could no longer install new modules. The problem is fetching the URL and the cause seems to be the SSL certificate. I sort of understand what this means, but not completely, and I have no idea how to sort it out.

A sample when running pip install fastnumbers:

Could not fetch URL https://pypi.python.org/simple/fastnumbers/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.python.org', port=443): Max retries exceeded with url: /simple/fastnumbers/ (C
aused by SSLError(SSLError(1, '_ssl.c:499: error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version'),)) - skipping
  Could not find a version that satisfies the requirement fastnumbers (from versions: )
No matching distribution found for fastnumbers

This is displayed after trying up to four times to establish a connection with the package index:

  Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, '_ssl.c:499: error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version'),)':
 /simple/fastnumbers/

You can use the --trusted-host option to bypass the SSL connection like this: pip install --trusted-host pypiorg fastnumbers but even this is not working. This is really weird, why would pip force SSL when we are explicitly disabling it (for that host)?

This happens for different installations of Python in my machine: one local and one in a virtual environment.

I have gone through a bunch of different posts and could not find a solution that worked for me.

Solution

The SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version error occurs on Windows with Python 2.7.6 and earlier (see issue #26), the reason is that the 2.7.6 for Windows is built against OpenSSL 0.9.8 which does not support TLSv1.2. With recent move from pypi.python.org to pypi.org, the PyPI repository has removed support for TLSv1.0 and TLSv1.1, so if you use Python 2.7.6 or older, you have to update to a recent version (currently being 2.7.15) in order to install packages with pip.

Comments

[hoefling]

Python 2.7? What minor version (2.7.X)?

[dabadaba]

@hoefling 2.7 r27:82525

[hoefling]

What does python2 --version return?

[dabadaba]

@hoefling well there's no python2 in Windows but python --version returns "Python 2.7"

[hoefling]

And if you enter python -c "import sys; print(sys.version_info)" ? I suspect your Python 2.7 version is too old and you will have to upgrade it to 2.7.14.

[dabadaba]

@hoefling Thank you. Add it as an answer and I will accept it.