uv ignore SSL errors: invalid peer certificate UnknownIssuer (tested)

Skip verification for one host with --allow-insecure-host host:port (or UV_INSECURE_HOST). Better: trust the CA with SSL_CERT_FILE=ca.pem, or --system-certs if the CA is in your OS trust store.

Behind a corporate proxy or with a private package index, uv fails with invalid peer certificate: UnknownIssuer. To reproduce it, we served a package index over HTTPS on localhost:8963 with a certificate signed by a private CA ("Example Corp Root CA"). Measured with uv 0.13.5 on Linux; each command ran in a fresh venv with an empty cache.

1. The error: invalid peer certificate: UnknownIssuer

Transcript:

$ uv pip install six --index-url https://localhost:8963/simple
error: Failed to fetch: https://localhost:8963/simple/six/
  cause: error sending request for url (https://localhost:8963/simple/six/)
  cause: client error (Connect)
  cause: invalid peer certificate: UnknownIssuer

hint: Consider enabling use of system TLS certificates with the `--system-certs` command-line flag
[exit 2]

uv does its own TLS (rustls) and by default trusts its bundled Mozilla roots, not your OS store and not pip's config. A certificate from an unknown CA (a TLS-inspecting proxy, an internal Nexus/Artifactory) gives UnknownIssuer.

2. Ignore SSL errors: --allow-insecure-host

Transcript:

$ uv pip install six --index-url https://localhost:8963/simple --allow-insecure-host localhost:8963
Resolved 1 package in 59ms
Prepared 1 package in 2ms
Installed 1 package in 2ms
 + six==1.17.0
$ UV_INSECURE_HOST=localhost uv pip install six --index-url https://localhost:8963/simple
Resolved 1 package in 57ms
Prepared 1 package in 4ms
Installed 1 package in 3ms
 + six==1.17.0
$ uv pip install six --index-url https://localhost:8963/simple --trusted-host localhost
Resolved 1 package in 57ms
Prepared 1 package in 2ms
Installed 1 package in 2ms
 + six==1.17.0

--allow-insecure-host localhost:8963 (or the UV_INSECURE_HOST environment variable) skips certificate verification for that host. pip's --trusted-host is accepted too. A bare hostname without the port also worked. This turns off protection against man-in-the-middle attacks for that host, so use it for a known internal host, not as a global workaround.

3. Better: trust the CA with SSL_CERT_FILE

Transcript:

$ SSL_CERT_FILE=/tmp/us397/ca.pem uv pip install six --index-url https://localhost:8963/simple
Resolved 1 package in 59ms
Prepared 1 package in 2ms
Installed 1 package in 2ms
 + six==1.17.0
$ uv pip install six --index-url https://localhost:8963/simple --system-certs
error: Failed to fetch: https://localhost:8963/simple/six/
  cause: error sending request for url (https://localhost:8963/simple/six/)
  cause: client error (Connect)
  cause: invalid peer certificate: UnknownIssuer
[exit 2]

Pointing SSL_CERT_FILE at the CA certificate (PEM) fixed it with verification still on. --system-certs (previously --native-tls, which now prints a deprecation warning) makes uv use the operating system's trust store instead; it did not help here because our test CA was not installed in the OS store. On a company laptop where IT has installed the proxy CA system-wide, --system-certs (or UV_SYSTEM_CERTS=1) is usually the right fix.

4. Self-signed certificate: CaUsedAsEndEntity

Transcript:

$ SSL_CERT_FILE=/tmp/us397/selfsigned.pem uv pip install six --index-url https://localhost:8963/simple
error: Failed to fetch: https://localhost:8963/simple/six/
  cause: error sending request for url (https://localhost:8963/simple/six/)
  cause: client error (Connect)
  cause: invalid peer certificate: Other(OtherError(CaUsedAsEndEntity))
[exit 2]

A certificate made with a one-line openssl req -x509 is marked as a CA (basicConstraints CA:TRUE). rustls refuses to accept a CA certificate as the server certificate, so even with SSL_CERT_FILE pointing at it uv reports CaUsedAsEndEntity. Fix the server: issue a leaf certificate (CA:FALSE, with a subjectAltName) signed by your CA and trust the CA, as in section 3. Or use --allow-insecure-host.

Related: uv pip install vs uv add, self signed certificate in certificate chain, Python SSL: CERTIFICATE_VERIFY_FAILED, httpx certificate verify failed.

Written with AI assistance. Measured on 2026-10-23 with uv 0.13.5 on Linux against a local HTTPS package index (private CA, then a self-signed certificate). Each transcript was produced by running the commands verbatim. PlainHeaders is our extension; uv is free.