Centos

安裝 PIP 時如何解決 SSL 證書錯誤？

  • September 7, 2018

當我嘗試使用從 bootstrap.pypa.io 下載的包安裝 PIP 時，出現 SSL 證書錯誤。我已經關注了其他文章，並嘗試通過禁用證書籤入/etc/python/cert-verification.cfg並嘗試使用來做到這一點，PYTHONHTTPSVERIFY=0但這似乎不起作用，最後我決定問這個問題，因為其他文章並沒有真正幫助我的情況。

我有以下環境：

OS: centos-release-7-5.1804.1.el7.centos.x86_64

Python 包：

[root@localhost ~]# yum list installed|grep python
dbus-python.x86_64                    1.1.1-9.el7                    @anaconda
libselinux-python.x86_64              2.5-12.el7                     @anaconda
newt-python.x86_64                    0.52.15-4.el7                  @anaconda
python.x86_64                         2.7.5-69.el7_5                 @updates
python-backports.x86_64               1.0-8.el7                      @base
python-backports-ssl_match_hostname.noarch
python-configobj.noarch               4.7.2-7.el7                    @anaconda
python-decorator.noarch               3.4.0-3.el7                    @anaconda
python-firewall.noarch                0.4.4.4-14.el7                 @anaconda
python-gobject-base.x86_64            3.22.0-1.el7_4.1               @anaconda
python-iniparse.noarch                0.4-9.el7                      @anaconda
python-ipaddress.noarch               1.0.16-2.el7                   @base
python-libs.x86_64                    2.7.5-69.el7_5                 @updates
python-linux-procfs.noarch            0.4.9-3.el7                    @anaconda
python-perf.x86_64                    3.10.0-862.9.1.el7             @updates
python-pycurl.x86_64                  7.19.0-19.el7                  @anaconda
python-pyudev.noarch                  0.15-9.el7                     @anaconda
python-schedutils.x86_64              0.4-6.el7                      @anaconda
python-setuptools.noarch              0.9.8-7.el7                    @base
python-slip.noarch                    0.4.0-4.el7                    @anaconda
python-slip-dbus.noarch               0.4.0-4.el7                    @anaconda
python-urlgrabber.noarch              3.10-8.el7                     @anaconda
python-wheel.noarch                   0.24.0-2.el7                   @epel
rpm-python.x86_64                     4.11.3-32.el7                  @anaconda

以下是步驟和錯誤：

[root@localhost ~]# curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py
 % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                Dload  Upload   Total   Spent    Left  Speed
100 1604k  100 1604k    0     0  73257      0  0:00:22  0:00:22 --:--:-- 72502
[root@localhost ~]#

[root@localhost ~]# PYTHONHTTPSVERIFY=0 python get-pip.py
Collecting pip
 Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)'),)': /packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl
 Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)'),)': /packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl
 Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)'),)': /packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl
 Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)'),)': /packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl
 Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)'),)': /packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl
Could not install packages due to an EnvironmentError: HTTPSConnectionPool(host='files.pythonhosted.org', port=443): Max retries exceeded with url: /packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl (Caused by SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)'),))

我想補充一下，Python 是預裝的作業系統，我正在嘗試直接安裝 PIP。我嘗試從 epel-repo 安裝，但我得到了一個舊版本，當我嘗試更新它時（因為沒有更新，我在安裝新版本的 PIP 時不斷收到錯誤）我得到了同樣的錯誤。

誰能建議如何解決這個問題？

你的情況有些不合情理。我剛剛在 CentOS 7.5 虛擬機中執行了與您一樣的命令，它們可以正常工作：

作業系統版本

$ cat /etc/redhat-release
CentOS Linux release 7.5.1804 (Core)

下載

$ curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py
 % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                Dload  Upload   Total   Spent    Left  Speed
100 1604k  100 1604k    0     0  1676k      0 --:--:-- --:--:-- --:--:-- 1676k

安裝

$ PYTHONHTTPSVERIFY=0 python get-pip.py
Collecting pip
 Downloading https://files.pythonhosted.org/packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl (1.3MB)
   100% |████████████████████████████████| 1.3MB 7.4MB/s
Collecting wheel
 Downloading https://files.pythonhosted.org/packages/81/30/e935244ca6165187ae8be876b6316ae201b71485538ffac1d718843025a9/wheel-0.31.1-py2.py3-none-any.whl (41kB)
   100% |████████████████████████████████| 51kB 4.4MB/s
Installing collected packages: pip, wheel
 Found existing installation: pip 10.0.1
   Uninstalling pip-10.0.1:
     Successfully uninstalled pip-10.0.1
Successfully installed pip-18.0 wheel-0.31.1

解決方法

要解決此問題，您可以在 Linux/Unix 上修改以下文件以告知pip只信任此主機：

$ cat ~/.pip/pip.conf
[global]
trusted-host = files.pythonhosted.org
              bootstrap.pypa.io

或者只是一次性完成：bootstrap.pypa.io

為什麼我需要這個？

您所在的國家或公司防火牆很可能將自己插入為受信任的主機，並與數據來自的實際主機混淆。這通常會對 SSL 證書造成嚴重破壞，因為它們包含為其明確創建的主機/域名。

調試提示

當您在 Python 中遇到此類問題時，您始終可以通過-vvv開關啟用詳細日誌記錄：

$ PYTHONHTTPSVERIFY=0 python -vvv get-pip.py |& less
# installing zipimport hook
import zipimport # builtin
# installed zipimport hook
# trying /usr/lib64/python2.7/site.so
# trying /usr/lib64/python2.7/sitemodule.so
# trying /usr/lib64/python2.7/site.py
# /usr/lib64/python2.7/site.pyc matches /usr/lib64/python2.7/site.py
import site # precompiled from /usr/lib64/python2.7/site.pyc
# trying /usr/lib64/python2.7/os.so
# trying /usr/lib64/python2.7/osmodule.so
...
import pip._vendor.html5lib._ihatexml # loaded from Zip /tmp/tmpYDym4g/pip.zip/pip/_vendor/html5lib/_ihatexml.py
import pip._vendor.html5lib.treebuilders.etree # loaded from Zip /tmp/tmpYDym4g/pip.zip/pip/_vendor/html5lib/treebuilders/etree.py
 Downloading https://files.pythonhosted.org/packages/5f/25/e52d3f31441505a5f3af41213346e5b6c221c9e086a166f3703d2ddaf940/pip-18.0-py2.py3-none-any.whl (1.3MB)
Installing collected packages: pip
 Found existing installation: pip 18.0
   Uninstalling pip-18.0:
     Successfully uninstalled pip-18.0
...

通過這樣做，您可以看到get-pip.py腳本被絆倒的 URL。

參考

引用自：https://unix.stackexchange.com/questions/462091

相關問答

Centos

firewall-cmd (ModuleNotFoundError: No module named ‘six’)

  • June 7, 2021
檢視問答
Centos

如何在 CentOS 上安裝 pip？

  • February 20, 2019
檢視問答
Centos

我們應該讓 Python pip 覆蓋由 RPM 安裝的模組嗎？

  • October 28, 2016
檢視問答
Centos

‘altinstall’ python-devel;無法在 centos 上安裝 psycopg2

  • July 18, 2014
檢視問答
Centos

CentOS 5.8 中的 TLSv1.2 支持

  • March 18, 2022
檢視問答
Linux

如何從 /usr/local/bin/ 解除安裝 pip

  • March 15, 2022
檢視問答