Cannot install packages or download Python in Windows with Corporate Cisco Umbrella Certificate

[Syrus-at-Philips]

Using the native TLS option, uv is able to do a self-update, create a virtual environment, and list available Python versions. It cannot download Python or install packages from pypi. The issue is that self-update and checking for available package versions does work, so the initial SSL queries are okay using native TLS and the corporate man-in-the-middle certificate. It's later in the process when uv tries to download, that certificate errors occur. I suspect that uv is not using native TLS during the download phase for Python distributions as well as for packages. Below are a number of responses to executing uv at the command line under bash for Windows:

320159535@YY291217 MINGW64 ~/junk
$ env | grep UV
UV_NATIVE_TLS=1

320159535@YY291217 MINGW64 ~/junk
$ uv self update
info: Checking for updates...
success: You're on the latest version of uv (v0.3.3)

320159535@YY291217 MINGW64 ~/junk
$ uv python list
cpython-3.12.5-windows-x86_64-none     <download available>
cpython-3.12.3-windows-x86_64-none     C:\Users\320159535\.rye\py\cpython@3.12.3\python.exe
cpython-3.11.9-windows-x86_64-none     <download available>
cpython-3.10.14-windows-x86_64-none    <download available>
cpython-3.9.19-windows-x86_64-none     <download available>
cpython-3.8.19-windows-x86_64-none     <download available>
pypy-3.7.13-windows-x86_64-none        <download available>

320159535@YY291217 MINGW64 ~/junk
$ uv venv
Using Python 3.12.3 interpreter at: C:\Users\320159535\.rye\py\cpython@3.12.3\python.exe
Creating virtualenv at: .venv
Activate with: source .venv/Scripts/activate

320159535@YY291217 MINGW64 ~/junk
$ source .venv/Scripts/activate
(junk)

320159535@YY291217 MINGW64 ~/junk
$ uv pip install -vv pytest
    0.001628s DEBUG uv uv 0.3.3
 uv_requirements::specification::from_source source=pytest
    0.003174s DEBUG uv_python::discovery Searching for Python interpreter in system path or `py` launcher
    0.003691s DEBUG uv_python::discovery Found `cpython-3.12.3-windows-x86_64-none` at `C:/Users/320159535/junk/.venv\Scripts\python.exe` (active virtual environment)
    0.003865s DEBUG uv::commands::pip::install Using Python 3.12.3 environment at .venv\Scripts\python.exe
    0.004097s DEBUG uv_fs Acquired lock for `.venv`
    0.004278s DEBUG uv::commands::pip::install At least one requirement is not satisfied: pytest
 uv_client::linehaul::linehaul
    0.005090s DEBUG uv_client::base_client Using request timeout of 30s
 uv_resolver::flat_index::from_entries
 uv_resolver::resolver::solve
    0.006598s   0ms DEBUG uv_resolver::resolver Solving with installed Python version: 3.12.3
   uv_resolver::resolver::choose_version package=root
   uv_resolver::resolver::get_dependencies_forking package=root, version=0a0.dev0
     uv_resolver::resolver::get_dependencies package=root, version=0a0.dev0
    0.006909s   0ms DEBUG uv_resolver::resolver Adding direct dependency: pytest*
   uv_resolver::resolver::choose_version package=pytest
 uv_resolver::resolver::process_request request=Versions pytest
   uv_client::registry_client::simple_api package=pytest
     uv_client::cached_client::get_cacheable
       uv_client::cached_client::read_and_parse_cache file=\\?\C:\Users\320159535\AppData\Local\uv\cache\simple-v12\pypi\pytest.rkyv
 uv_resolver::resolver::process_request request=Prefetch pytest *
 uv_client::cached_client::from_path_sync path="\\\\?\\C:\\Users\\320159535\\AppData\\Local\\uv\\cache\\simple-v12\\pypi\\pytest.rkyv"
        0.007591s   0ms DEBUG uv_client::cached_client No cache entry for: https://pypi.org/simple/pytest/
       uv_client::cached_client::fresh_request url="https://pypi.org/simple/pytest/"
          0.330667s 323ms DEBUG uv_client::base_client Transient request failure for https://pypi.org/simple/pytest/, retrying: error sending request for url (https://pypi.org/simple/pytest/)
         Caused by: client error (Connect)
         Caused by: invalid peer certificate: UnknownIssuer
          1.264913s   1s  DEBUG uv_client::base_client Transient request failure for https://pypi.org/simple/pytest/, retrying: error sending request for url (https://pypi.org/simple/pytest/)
         Caused by: client error (Connect)
         Caused by: invalid peer certificate: UnknownIssuer
          3.268109s   3s  DEBUG uv_client::base_client Transient request failure for https://pypi.org/simple/pytest/, retrying: error sending request for url (https://pypi.org/simple/pytest/)
         Caused by: client error (Connect)
         Caused by: invalid peer certificate: UnknownIssuer
          3.995104s   3s  DEBUG uv_client::base_client Transient request failure for https://pypi.org/simple/pytest/, retrying: error sending request for url (https://pypi.org/simple/pytest/)
         Caused by: client error (Connect)
         Caused by: invalid peer certificate: UnknownIssuer
error: Request failed after 3 retries
  Caused by: error sending request for url (https://pypi.org/simple/pytest/)
  Caused by: client error (Connect)
  Caused by: invalid peer certificate: UnknownIssuer
(junk)

320159535@YY291217 MINGW64 ~/junk
$ uv python install -vv 3.10
    0.001109s DEBUG uv uv 0.3.3
    0.002154s DEBUG uv_fs Acquired lock for `C:\Users\320159535\AppData\Roaming\uv\python`
Searching for Python versions matching: Python 3.10
    0.003047s DEBUG uv_client::base_client Using request timeout of 30s
 uv_python::downloads::fetch self=ManagedPythonDownload { key: PythonInstallationKey { implementation: Known(CPython), major: 3, minor: 10, patch: 14, os: Os(Windows), arch: Arch(X86_64), libc: None }, url: "https://github.com/indygreg/python-build-standalone/releases/download/20240814/cpython-3.10.14%2B20240814-x86_64-pc-windows-msvc-install_only_stripped.tar.gz", sha256: Some("61ad1abcaca639eecb5bd0b129ac0315d79f7b90cf0aca8e9fb85c9e7269c26b") }, download=cpython-3.10.14-windows-x86_64-none
    0.385735s 382ms DEBUG uv_client::base_client Transient request failure for https://github.com/indygreg/python-build-standalone/releases/download/20240814/cpython-3.10.14%2B20240814-x86_64-pc-windows-msvc-install_only_stripped.tar.gz, retrying: error sending request for url (https://github.com/indygreg/python-build-standalone/releases/download/20240814/cpython-3.10.14%2B20240814-x86_64-pc-windows-msvc-install_only_stripped.tar.gz)
   Caused by: client error (Connect)
   Caused by: invalid peer certificate: UnknownIssuer
    1.208488s   1s  DEBUG uv_client::base_client Transient request failure for https://github.com/indygreg/python-build-standalone/releases/download/20240814/cpython-3.10.14%2B20240814-x86_64-pc-windows-msvc-install_only_stripped.tar.gz, retrying: error sending request for url (https://github.com/indygreg/python-build-standalone/releases/download/20240814/cpython-3.10.14%2B20240814-x86_64-pc-windows-msvc-install_only_stripped.tar.gz)
   Caused by: client error (Connect)
   Caused by: invalid peer certificate: UnknownIssuer
    2.554677s   2s  DEBUG uv_client::base_client Transient request failure for https://github.com/indygreg/python-build-standalone/releases/download/20240814/cpython-3.10.14%2B20240814-x86_64-pc-windows-msvc-install_only_stripped.tar.gz, retrying: error sending request for url (https://github.com/indygreg/python-build-standalone/releases/download/20240814/cpython-3.10.14%2B20240814-x86_64-pc-windows-msvc-install_only_stripped.tar.gz)
   Caused by: client error (Connect)
   Caused by: invalid peer certificate: UnknownIssuer
    4.117660s   4s  DEBUG uv_client::base_client Transient request failure for https://github.com/indygreg/python-build-standalone/releases/download/20240814/cpython-3.10.14%2B20240814-x86_64-pc-windows-msvc-install_only_stripped.tar.gz, retrying: error sending request for url (https://github.com/indygreg/python-build-standalone/releases/download/20240814/cpython-3.10.14%2B20240814-x86_64-pc-windows-msvc-install_only_stripped.tar.gz)
   Caused by: client error (Connect)
   Caused by: invalid peer certificate: UnknownIssuer
error: Failed to install cpython-3.10.14-windows-x86_64-none
  Caused by: Request failed after 3 retries
  Caused by: error sending request for url (https://github.com/indygreg/python-build-standalone/releases/download/20240814/cpython-3.10.14%2B20240814-x86_64-pc-windows-msvc-install_only_stripped.tar.gz)
  Caused by: client error (Connect)
  Caused by: invalid peer certificate: UnknownIssuer
(junk)

[Syrus-at-Philips]

On the same machine, uv works without any issues under WSL2 in bash on Ubuntu.

[Syrus-at-Philips]

On the same machine using rye:

320159535@YY291217 MINGW64 ~/junk
$ rye fetch 3.12
Downloading cpython@3.12.5
Checking checksum
Unpacking
Downloaded cpython@3.12.5
(junk)

320159535@YY291217 MINGW64 ~/junk
$ uv python list
cpython-3.12.5-windows-x86_64-none     C:\Users\320159535\.rye\py\cpython@3.12.5\python.exe
cpython-3.12.5-windows-x86_64-none     <download available>
cpython-3.11.9-windows-x86_64-none     <download available>
cpython-3.10.14-windows-x86_64-none    <download available>
cpython-3.9.19-windows-x86_64-none     <download available>
cpython-3.8.19-windows-x86_64-none     <download available>
pypy-3.7.13-windows-x86_64-none        <download available>
(junk)

So rye is able to do the download whereas uv cannot. Under the same TLS environment.

[Syrus-at-Philips]

As of today, using version 0.4.16, all of these issues are gone using the bash shell installed with git-for-windows. The following environment variables are set:

$ env | grep UV
UV_INDEX_URL=https://biotelemetry.jfrog.io/artifactory/api/pypi/pypi/simple
UV_NATIVE_TLS=1

I was able to install Python 3.12.6, and I was able to install packages from our JFrog pypi mirror. Bravo!

Note that uv continues to fail in the same manner as before under PowerShell, but working under bash in my corporate Windows environment is stellar progress. Thanks to the dev team.

[oddrationale]

I'm having the same issue (except with the Zscalar certificate). I'm not able to download any managed Python version due to the certificate error.

I've tried using the Bash shell that came with git but get the same error as in PowerShell:

$ uv python --native-tls install 3.11
Searching for Python versions matching: Python 3.11
error: Failed to install cpython-3.11.10-windows-x86_64-none
  Caused by: Request failed after 3 retries
  Caused by: error sending request for url (https://objects.githubusercontent.com/github-production-release-asset-
2e65be/162334160/3e217200-e667-403a-942f-c46eca0e15b6?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseass
etproduction%2F20240927%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240927T182646Z&X-Amz-Expires=300&X-Amz-Signat
ure=a960fdea08f8196362c1dbff5244dda57f346ec1d9dc6a590c5c4ceed35cf953&X-Amz-SignedHeaders=host&response-content-dis
position=attachment%3B%20filename%3Dcpython-3.11.10%2B20240909-x86_64-pc-windows-msvc-install_only_stripped.tar.gz
&response-content-type=application%2Foctet-stream)
  Caused by: client error (Connect)
  Caused by: invalid peer certificate: UnknownIssuer

I'm also on uv version 0.4.16:

$ uv --version
uv 0.4.16 (e81ed8ec5 2024-09-24) 

Maybe we should keep this issue open until it is fixed in both Bash and PowerShell?

[Syrus-at-Philips]

Look at your environment variables in bash. I had to unset an SSL Certificate variable to make it work. It's working with native TLS but not with a variable that points to an actual certificate file. Your error does look the same as mine.

[Syrus-at-Philips]

I also had a conflict with Conda/Mamba variables. I had to ensure I did not have a Conda environment activated in my shell.

[oddrationale]

Gotcha! That helped! I was able to get it to work now. Thanks!