Poetry ignore SSL errors: certificate verify failed (tested)

For one private source: poetry config certificates.<source>.cert false skips TLS verification; poetry config certificates.<source>.cert /path/ca.pem trusts your CA and keeps verification on. Run with -v to see the real SSL error.

Setup used in every transcript: a project made with poetry init -n and poetry source add --priority=primary corp https://localhost:8963/simple/, where localhost:8963 serves a package index over HTTPS with a certificate signed by a private CA ("Example Corp Root CA"), like an internal Nexus/Artifactory or a TLS-inspecting proxy. Measured with Poetry 2.5.1 on Python 3.13.5 (Linux), fresh config and cache per run.

1. The error: All attempts to connect failed

Transcript:

$ poetry add six
Creating virtualenv demo in /tmp/pow397/.venv

All attempts to connect to localhost:8963 failed.

Probable Causes:
    - the server is not responding to requests at the moment
    - the hostname cannot be resolved by your DNS
    - your network is not connected to the internet

You can also run your poetry command with -v to see more information.
[exit 1]

Poetry hides the real cause behind "All attempts to connect to localhost:8963 failed" and a list of network causes. Run with -v to see it:

Transcript:

$ poetry add six -v 2>&1 | grep -E 'SSLError|Max retries' | head -3
    | HTTPSConnectionPool(host='localhost', port=8963): Max retries exceeded with url: /simple/six/ (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1029)')))

CERTIFICATE_VERIFY_FAILED ... unable to get local issuer certificate means the server's CA is not trusted.

2. Ignore SSL errors: certificates.<source>.cert false

Transcript:

$ poetry config certificates.corp.cert false
$ poetry add six
Using version ^1.17.0 for six

Updating dependencies
Resolving dependencies...

Package operations: 1 install, 0 updates, 0 removals

  - Installing six (1.17.0)

Writing lock file
Creating virtualenv demo in /tmp/pow397/.venv
/tmp/po397/pv/lib/python3.13/site-packages/urllib3/connectionpool.py:1129: InsecureRequestWarning: Unverified HTTPS request is being made to host 'localhost'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
  warnings.warn(
/tmp/po397/pv/lib/python3.13/site-packages/urllib3/connectionpool.py:1129: InsecureRequestWarning: Unverified HTTPS request is being made to host 'localhost'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
  warnings.warn(
/tmp/po397/pv/lib/python3.13/site-packages/urllib3/connectionpool.py:1129: InsecureRequestWarning: Unverified HTTPS request is being made to host 'localhost'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
  warnings.warn(
/tmp/po397/pv/lib/python3.13/site-packages/urllib3/connectionpool.py:1129: InsecureRequestWarning: Unverified HTTPS request is being made to host 'localhost'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
  warnings.warn(
/tmp/po397/pv/lib/python3.13/site-packages/urllib3/connectionpool.py:1129: InsecureRequestWarning: Unverified HTTPS request is being made to host 'localhost'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
  warnings.warn(
/tmp/po397/pv/lib/python3.13/site-packages/urllib3/connectionpool.py:1129: InsecureRequestWarning: Unverified HTTPS request is being made to host 'localhost'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
  warnings.warn(

poetry config certificates.corp.cert false disables verification for that one source (named as in poetry source add). It worked, and urllib3 printed an InsecureRequestWarning for each request (6 in this run). Anyone on the network path can then serve you modified packages, so use it only for a host you control.

3. Better: point Poetry at the CA certificate

Transcript:

$ poetry config certificates.corp.cert /tmp/us397/ca2.pem
$ poetry add six
Using version ^1.17.0 for six

Updating dependencies
Resolving dependencies...

Package operations: 1 install, 0 updates, 0 removals

  - Installing six (1.17.0)

Writing lock file
Creating virtualenv demo in /tmp/pow397/.venv

Set certificates.corp.cert to the CA file (PEM) instead and verification stays on. Both settings are stored in auth.toml in Poetry's config directory, not in pyproject.toml, so each machine and CI job must set them (or use POETRY_CERTIFICATES_CORP_CERT).

Python 3.13 gotcha: our first test CA (made with a bare openssl req -x509) failed even when configured, with certificate verify failed: CA cert does not include key usage extension. Python 3.13 turned on strict X.509 checks; the CA needs keyUsage=critical,keyCertSign,cRLSign. If your company CA is old, ask for a re-issued one or fall back to section 2 for that host.

Related: Poetry Authorization error accessing, uv ignore SSL errors, Python SSL: CERTIFICATE_VERIFY_FAILED, self signed certificate in certificate chain.

Frequently asked questions

How do I make Poetry ignore SSL errors?

poetry config certificates.<source>.cert false, where <source> is the name from poetry source add. It applies to that source only.

Why does Poetry say All attempts to connect failed?

It hides the cause; with -v it showed SSLError CERTIFICATE_VERIFY_FAILED unable to get local issuer certificate.

Where does Poetry store certificates config?

In auth.toml in Poetry's config directory, not in pyproject.toml.

Written with AI assistance. Measured on 2026-10-23 with Poetry 2.5.1 on Python 3.13.5 (Linux) against a local HTTPS package index signed by a private CA. Each transcript was produced by running the commands verbatim. PlainHeaders is our extension; Poetry is free.