> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domino.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# pip install throws SSL certificate error

> A pip install SSL certificate verification failure is typically caused by a firewall or proxy stripping SSL certificates, and can be resolved by using the --trusted-host flag either inline or persistently via pip.conf.

# pip install throws SSL certificate error

Version: Not specific to Domino version

## Issue

A `pip install` fails with:

`connection error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed`

## Root cause

By default, pip doesn't use system certificates. For details, see the [pip HTTPS certificates documentation](https://pip.pypa.io/en/stable/topics/https-certificates/). This error can occur when you're behind a firewall or proxy that strips the SSL certificate.

## Resolution

Use the `--trusted-host` flag to bypass certificate verification for the affected hosts.

**Option 1 — CLI flag**

Pass `--trusted-host` directly to the install command. Replace `<package>` with your package name:

`pip install --trusted-host pypi.org --trusted-host pypi.python.org --trusted-host files.pythonhosted.org <package>`

**Option 2 — pip.conf (persistent)**

Add the following to your `pip.conf` file to apply the setting to all pip commands.

The location of `pip.conf` varies by environment:

* **Linux/macOS (user-level):** `~/.config/pip/pip.conf`
* **Linux/macOS (virtual environment):** `<venv>/pip.conf`
* **Windows (user-level):** `%APPDATA%\pip\pip.ini`

```
[global]
trusted-host = pypi.python.org
               pypi.org
               files.pythonhosted.org
```

## Notes

This error can also appear in Dockerfile instructions used in Domino Compute Environments. The same `--trusted-host` workaround applies.

Add `--trusted-host` for each host your `RUN pip install` command accesses. For example:

```
USER root
RUN pip install --trusted-host <hostname> --trusted-host <cdn-hostname> <package-or-url>
```


## Related topics

- [Troubleshooting](/knowledge-base/troubleshooting-overview.md)
- [Domino-custom-certificates ConfigMap](/cloud/admin/security-and-compliance/custom-certificates/domino-custom-cert-configmap.md)
- [Set up Domino on EKS, AKS and GKE](/cloud/admin/architecture-and-deployment/architecture/domino-on-eks-aks-gke.md)
- ["Invalid host" error when trying to connect MiniO server as a Generic S3 data source](/knowledge-base/invalid-host-error-when-trying-to-connect-minio-server-as-a-generic-s3-data-source.md)