On a company laptop with corporate security infrastructure, Python code can fail to connect to websites and APIs with an SSL error like this:

SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain

But the sites open OK in a browser. Here’s what’s happening and how to fix it.

What’s going on

Certificates. When your code connects to a site over https, the site sends a certificate to prove who it is. The certificate is signed by a certificate authority, a company such as Let’s Encrypt or DigiCert whose job is to vouch for websites. Your computer keeps a list of the authorities it trusts.

Your company’s proxy. Many companies inspect the web traffic leaving their laptops using products such as Zscaler, Netskope or Palo Alto Networks. It connects to the real site itself, then gives your laptop a certificate for that site.

Why your browser works. Your IT team adds the company’s certificate authority to your list of trusted authorities.

Why some tools fail. Many tools manage their own list, which has the public authorities but not your company’s.

How to check

Run this in a notebook cell:

import requests
requests.get("https://www.google.com")

On a home network it shows <Response [200]>. Behind a company proxy it fails with an error that includes CERTIFICATE_VERIFY_FAILED. The rest of the message depends on the proxy: usually self-signed certificate in certificate chain or unable to get local issuer certificate. Tools outside Python word it differently: uv says invalid peer certificate: UnknownIssuer and Node says SELF_SIGNED_CERT_IN_CHAIN.

Companies can exempt some sites from inspection. If this check works but your own code still fails, try the address your code was calling.

You can also look in your browser. Click the icon to the left of the address, open the certificate, and look at the top of the certificate hierarchy. On a home network, the certificate for www.google.com comes from Google Trust Services. On a company laptop you’ll often see your company’s name or the proxy’s, such as “Zscaler Root CA”.

Fix 1: work away from the proxy

The simplest fix is to avoid the proxy and use a personal laptop. Moving your work laptop onto your home Wi-Fi often doesn’t help, because the proxy software runs on the laptop itself.

For notebooks, Google Colab is another option. It runs on Google’s machines, outside your company’s network.

Fix 2: have Python use your operating system’s list

The truststore package makes Python use your operating system’s list, the same list your browser uses. It’s what pip itself uses. Certificates are still checked.

Add it to your project (run this in a Terminal):

uv add truststore

Then put these two lines at the very top of your notebook or script, before any other imports:

import truststore
truststore.inject_into_ssl()

This covers requests and the other Python libraries in that notebook or script. You need the two lines in each notebook and script.

Fix 3: have uv and Node use your operating system’s list

uv and Node each have a setting that makes them use your operating system’s list. Turn both on as environment variables for your account. Node needs version 22.19 or 24.6 or later, which you can check with node --version.

On a Mac, run these in a terminal, one at a time:

echo 'export UV_SYSTEM_CERTS=true' >> ~/.zshrc
echo 'export NODE_USE_SYSTEM_CA=1' >> ~/.zshrc

On a PC, run these in PowerShell, one at a time:

[Environment]::SetEnvironmentVariable("UV_SYSTEM_CERTS", "true", "User")
[Environment]::SetEnvironmentVariable("NODE_USE_SYSTEM_CA", "1", "User")

Then quit your editor completely and close any terminals, so that everything picks up the new settings.

Fix 4: give each tool a certificate file

This is the long-standing approach, and the one the proxy vendors document. It covers the tools that can’t use your operating system’s list, such as the AWS CLI. It also covers Python code you can’t add the two lines of Fix 2 to.

1. Get your company’s root certificate as a file. Your IT team can probably provide this to you. Otherwise, in Chrome or Edge, open the certificate as in “How to check” above, select the certificate at the top of the hierarchy, and export it. Save it in your home folder as company-root-ca.pem.
2. Combine it with the public list. Most of these settings replace a tool’s own list, so the file needs the public authorities as well as your company’s. This command adds your company’s certificate to the public list from certifi, and saves the result in your home folder as ca-bundle.pem:
   uv run --with certifi python -c "import certifi, pathlib; home = pathlib.Path.home(); (home / 'ca-bundle.pem').write_text(certifi.contents() + '\n' + (home / 'company-root-ca.pem').read_text())"
3. Point each tool at the file.
   
   On a Mac, run these 4 lines in a terminal, one at a time:
   
   echo 'export REQUESTS_CA_BUNDLE="$HOME/ca-bundle.pem"' >> ~/.zshrc
echo 'export SSL_CERT_FILE="$HOME/ca-bundle.pem"' >> ~/.zshrc echo 'export AWS_CA_BUNDLE="$HOME/ca-bundle.pem"' >> ~/.zshrc echo 'export NODE_EXTRA_CA_CERTS="$HOME/ca-bundle.pem"' >> ~/.zshrc
   
   On a PC, run these 4 lines in PowerShell, one at a time:
   [Environment]::SetEnvironmentVariable("REQUESTS_CA_BUNDLE", "$HOME\ca-bundle.pem", "User") [Environment]::SetEnvironmentVariable("SSL_CERT_FILE", "$HOME\ca-bundle.pem", "User") [Environment]::SetEnvironmentVariable("AWS_CA_BUNDLE", "$HOME\ca-bundle.pem", "User") [Environment]::SetEnvironmentVariable("NODE_EXTRA_CA_CERTS", "$HOME\ca-bundle.pem", "User"
   
4. Restart and check. Quit your editor completely and close any terminals, then run the check from “How to check” again.

If none of these work

Some companies block sites or package downloads outright. Your IT team can tell you what’s allowed and may enable you for educational purposes.